Where are MAC used?

Question

I can think of where people use hashes and signatures. But where are MAC used in real life?

Are there any protocol in cryptography that uses MAC? Or examples where MACs are relevant?

score 9 · Answer 1 · edited Oct 07 '21 at 06:47

9

MACs are used all the time. Any time you want authenticated encryption, that is you want to send messages that can't be tampered by an attacker who lacks your secret key, you need to apply a MAC to every message you send as well as check a MAC for every message you receive.

Examples that I use on a daily basis include:

TLS (formerly known as SSL) used in HTTPS, FTPS, etc to provide Transport Layer Security providing authenticated encryption (AE) at the transport layer (TCP),
IPSec common in VPNs that provides AE at the internet (IP) layer. For info on the MAC usage, search the Cryptographic Suites for IPSec RFC for integrity and you'll find HMAC-SHA1-96/AES-XCBC-MAC-96, which are types of MACs,
SSH used to remotely connect to linux/unix machines which provides AE between client and host,
WPA2 used to provide AE between your wireless router and your wifi device. Note in the networking literature it's called a Message Integrity Code (MIC) to limit confusion as MAC typically refers to the MAC address (Media Access Control) - the link layer address.

edited Oct 07 '21 at 06:47

Community

1

answered Apr 27 '14 at 18:37

dr jimbob

39,312
8
94
164

I have a hard time figuring out in what part of TLS, a MAC is used. For SSH, is there a MAC included with every encrypted messages? – David 天宇 Wong Apr 27 '14 at 23:19
@David天宇Wong - For TLS consult RFC 5246 Sections 1 "Message transport includes a message integrity check using a keyed MAC" and section 6. For SSH consult RFC 4253 Section 6; basically yes a MAC is included with every encrypted packet. – dr jimbob Apr 27 '14 at 23:27
1

Also, it is used in good web apps to store your session cookie. – JZeolla Apr 28 '14 at 13:14
@SteelCityHacker - Agreed, a MAC is certainly one way to generate session cookies to prevent having to store every session cookie in the DB. That is in the cookie you have user_data + MAC(user_data) (user data being, user ID, login time, expiry time) and then you can check the user by seeing that their session cookie has a MAC that validates their user info. (Granted an alternative way is to just generate a random UUID for each session and store that random UUID in the DB and check it every time). – dr jimbob Apr 28 '14 at 16:45

Where are MAC used?

1 Answers1