What is HMAC

HMAC $($Hash Massage Authentication Code$)$ is an approach for creating

digital signatures using different hash algorithms like MD$5,$ SHA$1,$

SHA$256,$ SHA$512,$ etc...

Why do we need HMAC?

Short answer $-$ for digital signatures $($DA$)$ which give us data

Integrity and authentication. This is a unified approach for

applying a digital signature with a private key. Let's take a quick look at

how hashing$-$based DA works $($This part is optional and you can skip it$).$

Let's consider a scenario where Alice wants to securely send a message

to Bob, ensuring that the message remains unchanged during

transmission. Simultaneously, Bob needs to verify that the message

indeed originated from Alice. To achieve this, Alice decides to enhance

security by incorporating a secret key into the hashed message. For a

more in$-$depth understanding of this process, refer to the details on how

Digital Authentication $($DA$)$ works.

In practice, Alice combines the secret key with the hashed message

$($secret key $+$ hashed message$)$ and sends the resulting value along with

the original message. However, a challenge arises when Bob receives the

message and aims to verify its authenticity and integrity. To do this, Bob

replicates Alice's operation by taking the hashed message, adding the

secret key $($hashed message $+$ secret key$)($as you see Bob uses a

different order!$),$ and then comparing it with the value sent by Alice. If

these values match, it confirms that the message indeed originated from

Alice and remains unchanged. In this situation, even if the message

hasn't been altered by an attacker, Bob ends up with a different

outcome. This occurs because Bob doesn't follow the same order as Alice

$("$HelloBob$"$ is not equal "BobHello"$).$