# What is a Message Authentication Code (MAC)?

> A message authentication code (MAC) is a short cryptographic tag computed from a message and a secret key.

- Canonical URL: https://yellowcube.eu/glossary/message-authentication-code/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A party that knows the same key can recompute or verify the tag to detect changes and gain assurance that the message came from a key holder. The construction, key, tag length, and protocol rules determine the actual assurance.

MACs are symmetric: every verifier that holds the shared key can also create valid tags. Standard constructions include the keyed-hash message authentication code (HMAC) and cipher-based message authentication code (CMAC). A protocol must specify exactly which bytes and context are authenticated and how a received tag is checked.

### Key points

- **Covered data:** Authenticate the complete security-relevant representation, including identifiers, lengths, versions, algorithms, and context where needed; ambiguous encoding or omitted fields can enable substitution.
- **Key use:** Generate keys securely, limit their distribution, separate them from encryption and unrelated purposes, rotate them under policy, and handle compromise as affecting every holder.
- **Protocol design:** Use nonces, sequence numbers, timestamps, or other state when replay or reordering matters, and compare tags without leaking useful timing information.
- **Important limitation:** A MAC provides no confidentiality and ordinarily no non-repudiation because any shared-key holder can create a valid tag. It does not prevent replay by itself, and a verified tag says nothing about whether the authenticated content is safe or authorized.

### Related terms

[Cryptography](<https://yellowcube.eu/glossary/cryptography/>) · [Data integrity](<https://yellowcube.eu/glossary/data-integrity/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>) · [Encryption](<https://yellowcube.eu/glossary/encryption/>) · [Hardware security module (HSM)](<https://yellowcube.eu/glossary/hardware-security-module/>) · [Cryptographic hashing](<https://yellowcube.eu/glossary/cryptographic-hashing/>)

### Sources

[NIST, Message Authentication Codes](https://csrc.nist.gov/projects/message-authentication-codes) · [NIST SP 800-38B, Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication](https://csrc.nist.gov/pubs/sp/800/38/b/upd1/final) · [RFC 2104, HMAC: Keyed-Hashing for Message Authentication](https://www.rfc-editor.org/info/rfc2104/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.