gen-briefly-explain-an-hmac-and-one-common-misconception-about-i-ec36

Briefly explain an HMAC and one common misconception about it.

## HMAC (Hash-based Message Authentication Code) An HMAC is a cryptographic technique that combines a secret key with a message and a hash function to produce an authentication code. It allows you to verify both the **integrity** (message hasn't been altered) and **authenticity** (message came from someone with the secret key) of a message. The basic formula is: `HMAC(key, message) = Hash(key ⊕ opad || Hash(key ⊕ ipad || message))` ## Common Misconception **"HMAC provides encryption/confidentiality"** This is false. HMAC only verifies integrity and authenticity—it doesn't hide the message content. The original message is sent in plaintext alongside the HMAC. Anyone can read the message; they just can't modify it or forge a valid HMAC without knowing the secret key. If you need confidentiality, you must separately encrypt the message (a pattern called "encrypt-then-MAC" is often recommended).