Search code examples
encryptionhashcryptographyhmachash-function

Does HMAC encrypts the original Plaintext message?


So my Question is a combination of 3:

  1. Does HMAC hashing also hash the message along with the Secret key send to the recipient? Or just the Secret key is hashed, leaving the message as Plaintext?
  2. If ONLY the secret key is hashed(not hashing the message), doesn't it makes the message vulnerable to unauthorized people(attackers) if they get access to that Plaintext and easily understand it?
  3. If both(message + secret key) are concatenated to form the hash, how HMAC is different from the 'SALTING' method?

Solution

  • HMAC authenticates a message. It does not encrypt it. If you want to encrypt the message, encrypt it first, and then apply an HMAC. (This is generally called the "encrypt-then-MAC" construction.)

    The point of authentication is to demonstrate that a message has not been altered. The point of encryption is to prevent other parties from reading the message. Often these go together, but they don't have to.