A message authentication code (MAC) is a keyed value attached to a message so the recipient can check its integrity and origin. Unlike a plain hash, which anyone can calculate from the message, a MAC requires a secret key shared by the sender and recipient. An attacker may read or alter the message but cannot create a valid MAC without that key. section 4.5
Stopping a fraudulent refund
A payment service receives refunds.json from a warehouse service. A plain SHA-256 file hash can reveal accidental corruption, but an attacker could change both the refund file and its hash. With a MAC, the warehouse computes a value from the file and their shared secret; the payment service recomputes it and processes the file only when both values match. section 4.5
A MAC exchange follows this pattern:
- The sender creates the message, computes its MAC using the secret key, and sends both message and MAC. section 4.5
- The recipient computes a MAC over the received message and compares it with the supplied value. section 4.5
- Matching values indicate that the message was not modified and came from a party holding the shared key. section 4.5
- Do not improvise key mixing by hashing message || secret; use an established MAC construction such as HMAC. section 4.5
Figure 4.8 The MAC is data added to the end of a message that the receiver can use to verify who sent the message and whether it was tampered with.
Visualizes the MAC as data added to a message for checking its sender and detecting tampering. section 4.5
MACs can protect more than a standalone message. A MAC can cover a plaintext header together with an encrypted body, binding metadata to ciphertext and helping prevent header changes or message swapping. AEAD modes combine encryption and authentication in one operation. section 5.4
