HMACs rely on what cryptographic primitive to provide protection?

• A. Symmetric key encryption
• B. Public key encryption
• C. Hashing
• D. Digital signatures

Answer: (C)

HMACs are built on a cryptographic hash function as the fundamental primitive to provide a message authentication code. The secret key is combined with the message in a two-step hashing process (inner and outer) to produce a fixed-size tag that depends on both the key and the message. This design makes forging a valid tag infeasible without the key, because changing the message or guessing the key leads to an entirely different hash output. The security relies on the hash function’s one-way properties and its resistance to certain attacks, and the two-pass structure helps defend against length-extension issues that plain hashing could face. Since a MAC is intended for authentication and integrity, not confidentiality or non-repudiation, the underlying mechanism is hashing, not symmetric encryption, public-key encryption, or digital signatures.