keyedhash

KeyedHash refers to a class of cryptographic primitives that produce a fixed-size tag from an input message together with a secret key. Unlike ordinary (unkeyed) hash functions, keyed hashes provide both data integrity and authentication because only parties with the shared secret key can generate or verify the tag. In practice, keyed hashes are most commonly used as message authentication codes (MACs).

The most widely deployed construction is HMAC, which combines a hash function (for example SHA-256) with a secret key in a way that remains secure against common attacks, including length extension. Other examples include CMAC, which uses a block cipher (such as AES) to form a MAC, and universal hash-based MACs like UMAC and VMAC. Some references simply use the term KeyedHash to denote a MAC built from a keyed hash function.

Use cases for keyed hashes include verifying the integrity and authenticity of messages in transit, authenticating API requests, and generating tamper-evident tokens. Because the key is required for verification, keyed hashes do not provide non-repudiation in the way digital signatures do; they rely on symmetric key management rather than public-key infrastructure.

Security and implementation considerations emphasize proper key management, adequate key length, and choosing an appropriate tag length. Implementations should operate in constant time where possible to avoid timing side-channel leaks and comply with standard constructions like HMAC to benefit from established security proofs. Regular key rotation and separation of keys for different contexts are recommended practices.

See also: MAC, HMAC, CMAC, UMAC, VMAC, cryptographic hash function.