Message Authentication Codes
A cryptographic hash is a one-way (non-reversible) algorithm that applies a hash function and a secret key to any amount of input and returns a fixed-size output (the MAC). A MAC, short for Message Authentication Code, can be thought of as a keyed hash or checksum. Only if you hold the secret key used to calculate the MAC can you verify the MAC. MACs are used to ensure data integrity and authenticity.
How it works
Bob wants to send a message to Alice, and Bob wants Alice to be able to trust that the message she receives is from Bob and that it has not been modified in any way. So, Bob decides to create a MAC of the message that he wants to send Alice. Bob has already given Alice a copy of the HMAC key that Bob uses to compute the MAC.
Bob composes the following plaintext message: This is indeed a message from Bob, and it has not been altered.
Bob uses his HMAC key to compute the MAC of his message text. The MAC value for this particular key and text is: k8vifJC1F4sgg6pbeSpp9iMRfQ4r2hMD.
Bob sends the plaintext message along with the MAC value he computed to Alice.
Once she receives the message, Alice uses the HMAC key Bob gave her to compute the MAC value on the plaintext message Bob sent her.
When the MAC value Alice computes matches the MAC value Bob sent her, she can be confident that the message Bob sent her has not been altered (integrity), and Bob is the sender of the message (authenticity).
Supported algorithms
HMAC-SHA1
HMAC-SHA256
HMAC-SHA384
HMAC-SHA512
If you have an interest in storing passwords securely, you might think about creating a MAC at the application level (using one of the above CADP for Java supported algorithms) on your passwords and storing the MAC values instead of the plaintext passwords. That way you minimize the amount of time that passwords are in plaintext in your network.
MACs can be created through the XML interface and all of the Ingrian Cryptographic Providers except for the Ingrian MSCAPI Provider. The same plaintext value, MACed with the same key, always yields the same output.
By irreversible, it is meant that you cannot apply a reverse function to the MAC value to derive the original plaintext message.
