Message authentication code
A message authentication code is a keyed cryptographic value generated from a message to verify its integrity and authenticity.
Hacking Cryptography
An authentication tag is a value generated from a message and authentication key that enables verification of message integrity and key-based authenticity.
- How it is used
- Authenticates API requests and recovery links by letting shared-secret holders verify message integrity and origin.
- How deep it goes
- Works through secret-prefix API implementation and a SHA-256 length-extension exploit, then contrasts suffix MACs and HMAC.
- Examples
- Uses password-reset URLs, a shared-secret bank transaction API, and a forged SHA-256 request with amount 424242.
- What you can do after
- Evaluate/understand unsafe hash-based MAC constructions and choose HMAC or authenticated encryption instead.
Read how Hacking Cryptography explains message authentication code →
Software Security for Developers
A message authentication code is a keyed value that enables verification of a message's integrity and origin.
- How it is used
- Protects messages and encrypted payloads against tampering while authenticating a party that holds the shared secret.
- How deep it goes
- Explains keyed verification, exchange steps, hash contrast, and unsafe key concatenation, but avoids mathematical proofs and protocol internals.
- Examples
- Uses warehouse refunds, modified files, TLS tampering, and authenticated headers with encrypted bodies as concrete examples.
- What you can do after
- Diagnose tampering and apply keyed integrity checks when designing service-to-service messages or protected payloads.
Read how Software Security for Developers explains message authentication code →
Real-World Cryptography
An authentication tag is the deterministic output of a keyed authentication function used to verify a message's integrity and authenticity.
- How it is used
- Protects message integrity and authenticity between parties sharing a secret key, including cookies and cleartext or encrypted communications.
- How deep it goes
- Explains keyed tags, forgery, tag length, replay, timing attacks, HMAC, and KMAC, while deferring formal proof details.
- Examples
- Uses stateless cookies, two-party messages, Rust HMAC code, replay counters, and constant-time comparison code.
- What you can do after
- Apply HMAC to authenticate messages and verify tags safely while accounting for replay, serialization, length, and timing risks.
Read how Real-World Cryptography explains message authentication code →
Secure APIs
An authentication tag is cryptographic output used to verify the integrity and authenticity of authenticated-encrypted data.
- How it is used
- Uses the authentication tag to validate encrypted data and protected additional data.
- How deep it goes
- Defines the tag and identifies protected JWE components, without deriving its cryptographic construction.
- Examples
- Uses JWE field layouts and a protected JOSE header to illustrate where the authentication tag appears.
- What you can do after
- Evaluate whether encrypted data and associated protected data retain their integrity.
Related concepts
- HMACincludes · HMAC is a keyed message authentication code constructed from a cryptographic hash function and a secret key to authenticate data and verify its integrity.
- API keyuses · An API key is a credential used to identify or authorize a client accessing an application programming interface.
- symmetric key encryptionkind of · Symmetric-key encryption is cryptography that uses the same shared secret key, or equivalent derived key material, to encrypt and decrypt data.
- hash functionuses · A hash function deterministically maps input data to a value in a bounded output range, commonly for indexing, lookup, comparison, or integrity checking.
- kmacincludes · KMAC is a standardized message authentication code based on the SHA-3 sponge construction and a secret key.
- secret-prefix hashingincludes · Secret-prefix hashing is an authentication construction that prepends a secret to a message before hashing the resulting data.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.