HMAC
Abbreviation · Security & Infosec
Definitions
Hash-based Message Authentication Code — a construction that combines a cryptographic hash function with a secret key to produce a message authentication code. Verifies both data integrity and authenticity. Used in API authentication (webhook signatures), JWT HS256 signing, and TLS record verification. Resistant to length extension attacks unlike plain hashing.
In plain English: A way to create a signature for a message using a secret key, proving the message is authentic and unmodified.
Example: "Stripe signs webhooks with HMAC-SHA256 — compute the HMAC of the request body with your signing secret and compare it to the Stripe-Signature header."
Related Terms
- Wallet
- SLSA
- Digital Signature
- Passkey
- Post-Quantum Cryptography
- Boot Integrity
- Challenge-Response
- Cleartext
- Code Signing
- Crypto Agility
- Cryptographic Hash
- Entropy Analysis
- HMAC Authentication
- Message Authentication Code
- PBKDF2
- 802.1X
- Account Enumeration
- AES-GCM
- Anti-Replay
- Collision Resistance
- Cryptographic Signature
- Fabrication Attack
- Log Integrity
- Message Digest
- Non-Repudiation
- Post-Quantum
- RADIUS
- Relay Attack