Fundamentals of InfoSecadvanced
Explain how a Hashed Message Authentication Code differs from sending an unkeyed hash with a message.
Answer
An unkeyed hash can be recalculated by anyone who changes the message, so an attacker may replace both the message and hash. A Hashed Message Authentication Code uses a secret key with the hash-based process, allowing a receiver with the key to check whether the authentication value is valid.
Explanation
### The concept
A plain hash depends on message contents but not on a secret held by the sender and receiver. It can help detect a change when the expected hash is trusted. A Hashed Message Authentication Code (HMAC) incorporates a secret key into a hash-based authentication check. An outsider who lacks that key should not be able to create a valid authentication value merely by recalculating a plain hash. HMAC is not the same as encrypting the message.
### What a good answer covers
- A plain hash has no secret key.
- An attacker may replace an unprotected hash after changing data.
- HMAC uses a secret key with hashing.
- HMAC helps authenticate data and detect modification.
### Remember
A plain hash has no secret; HMAC adds a shared secret to the check.
Related Questions
- Explain why computer security is described as a process rather than a product. Include the roles of technology, people, and environment.(intermediate)
- Select ALL items the review identifies as possible security risks or losses.(intermediate)
- Arrange these broad security activities in a sensible cycle, beginning with identifying what needs protection.(intermediate)
- A security product can replace the continuing work of managing people, technology, and the operating environment.(intermediate)
- Which statement best captures the course review’s view of computer security?(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free