HMAC verifies integrity between parties sharing a key. Every party with that key can also create valid tags.
Evaluation approach
Define the sharing boundary. One secret embedded in every app copy cannot provide meaningful per-device identity.
Application example
HMAC may fit an internal server event channel, while a shared secret in a public mobile client presents a different threat model.
Limits and considerations
HMAC does not encrypt content or independently prevent replay.
Can a verifier also generate messages?
Knowing the shared key grants tag-generation ability. Sharing it across many services broadens that authority. Decide deliberately whether producers and verifiers should have equivalent power.
Checks and decisions
- Define secret scope
- Add freshness controls
- Assess confidentiality separately
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.