Explain like I'm five · InfoSec

What is a MAC/HMAC?

A Message Authentication Code (MAC/HMAC), told as a story about a confirmation seal stamped with a secret mold only the sender and receiver hold.

just stamped a fingerprint (hash)the receiver tries to confirm the note is unchanged, using just the fingerprint

The sender stamped the note with just a fingerprint (a hash).A fingerprint shows the content didn't change — but not who sent it.

a forger changes the contentand re-stamps a matching fingerprintthe fingerprint matches… but who sent this?a fingerprint needs no secret — so a forger can simply restamp a new one

Anyone can simply re-stamp the fingerprint.A fingerprint needs no secret to compute — so whoever changes the content can make a matching one too.

the secret moldstamped using the content + the moldthe receiver re-stamps with the same mold to compareMAC/HMAC = a seal nobody can stamp without the secret mold

MAC/HMAC is a confirmation seal stamped with a secret mold.Without the mold (the secret key), nobody can stamp a matching seal. → think of it as a fingerprint with a secret added in.

Needs the secret moldonly the sender and receiver hold it
Content + mold, stamped togetherHMAC = a hash combined with a secret key
No mold, no forgingre-stamping alone won't match
The receiver needs the same mold toothe mold must be shared beforehand
toolwhat it protectswho can make itfingerprint (hash)only that it's unchangedanyonesecret seal (MAC/HMAC)unchanged + who really sent itonly whoever holds the moldsealed letter (encryption)only that nobody else can read itonly the key holder can read it

A fingerprint, a secret seal, and a sealed letter, side by side.A fingerprint, a secret seal, and a sealed letter each keep a different promise — none stands in for another.

both sides must already share the mold, in advancea secret seal can't stop a sender claiming 'I never stamped this'for proof a third party can check, use the king's seal (PKI signing) instead

The mold must be shared in advance, and the seal can't stop a sender denying it later.The key-distribution problem remains, and if you need proof a third party can verify (non-repudiation), use the badge with the king's seal (a digital signature) instead.

In one breath

MAC/HMAC = a confirmation seal stamped on a message using a secret mold that only the sender and receiver hold. Without the mold nobody can stamp it, so it proves both it's unchanged and who really sent it.

A Message Authentication Code (MAC) uses the message and a shared secret key to produce a tag (HMAC does it with a hash function, CMAC with a block cipher); only a receiver holding the same key can recompute and verify the same tag. A keyless hash (a fingerprint) catches accidental changes but can't stop a deliberate edit, while a MAC protects both integrity and sender authentication. It still requires the key to be shared beforehand, though, and it doesn't provide non-repudiation — that's the job of a public-key digital signature (PKI).

When grown-ups say it

Message Authentication Code
A confirmation seal stamped with a secret mold. A tag made from the message combined with a shared secret key.
HMAC
A secret seal built out of a hash. The most common way to build a MAC, using a hash function.
Hash (fingerprint)
Anyone can compute it, no secret needed. It catches accidental changes, but a deliberate editor can simply recompute it. → a fingerprint on everything
Integrity
No tampering, in secret. Both a hash and a MAC protect this. → three things to keep
Sender authentication
Whether it really came from them. Proven because only the mold's holder can stamp a matching seal.
Key-distribution problem
The homework of sharing the mold beforehand. The remaining problem MAC/HMAC doesn't solve.
Non-repudiation
Ruling out claiming you never sent it. A MAC can't do this — the king's seal (a signature) can. → the badge with the king's seal
TLS
The promise behind a sealed back-and-forth letter. In practice it runs both a seal (encryption) and a secret stamp (a MAC) together. → the sealed promise with the shop
Next story
No Leaking Down, No Corrupting Up — Two Ladder Rules →
Want another term as a picture book? Request →