HMAC is best described as:

• A. A public-key signature algorithm
• B. A hash combined with a secret key for authentication
• C. A symmetric encryption scheme
• D. A hash function with no secret

Answer: (B)

HMAC is a keyed-hash message authentication code. It uses a cryptographic hash function together with a secret key to produce a short tag from the message. Because the key is needed to generate and verify the tag, HMAC provides both integrity (the message hasn’t been altered) and authentication (the holder of the secret key sent it). It isn’t a public-key signature, which relies on asymmetric keys; it isn’t encryption, which aims to hide content; and it isn’t just a plain hash, since the secret key is integral to producing the authentication tag. The inner/outer padding design strengthens security against certain attacks, so the tag remains trustworthy even if the underlying hash has weaknesses. HMAC is widely used to verify messages in protocols like TLS and IPsec.