Message Authentication Code (MAC)

Overview

A Message Authentication Code combines a secret key with message data to produce a fixed-length tag. A verifier with the same key recomputes the tag and confirms whether the received message was altered or created without authorized key possession.

MAC constructions include HMAC and algorithm-specific authenticated-encryption tags. Security depends on strong keys, unambiguous message encoding, domain separation, replay controls, and constant-time comparison of expected and received values.

Because every verifier can generate valid tags, a MAC does not provide public verification or strong nonrepudiation. Systems should rotate shared keys, limit their distribution, sign every security-relevant field, and reject malformed or stale messages. Protocols should define tag length and truncation rules explicitly for interoperability.

For Message Authentication Code (MAC), production scope should name the relevant endpoints, objects, workloads, secrets, dependencies, and tenant boundaries, the decision being supported, the accountable owner, and the time and jurisdiction boundaries.

Unlike a digital signature, a MAC is used by parties sharing a secret to verify integrity and origin; for example, an HMAC can authenticate a webhook payload but cannot provide public nonrepudiation.

A Message Authentication Code is a keyed cryptographic tag used to verify message integrity and authenticity between parties sharing secret material. A MAC provides shared-secret authenticity for exact message bytes, requiring protected keys, canonicalization, replay prevention, and safe verification.

For Message Authentication Code (MAC), the trust decision should establish a keyed cryptographic tag used to verify message integrity and authenticity between parties sharing secret material and bind the result to the requested action and protected resource. Teams should test issuance, storage, validation, expiry, revocation, recovery, and privileged override for identity proof and credential state, rather than checking only a successful request. Logs concerning the Message Authentication Code context and identity proof and credential state should support investigation without exposing reusable secrets or unnecessary personal data.