- https://developers.facebook.com/docs/graph-api/securing-requests
- https://security.stackexchange.com/questions/20129/how-and-when-do-i-use-hmac
- https://en.wikipedia.org/wiki/Digital_signature
- https://crypto.stackexchange.com/questions/5646/what-are-the-differences-between-a-digital-signature-a-mac-and-a-hash
A message authentication code (MAC) is produced from a message and a secret key by a MAC algorithm. A MAC of the same message produced by a different key looks unrelated. Even knowing the MAC of other messages does not help in computing the MAC of a new message.
An HMAC is a MAC which is based on a hash function. The basic idea is to concatenate the key and the message, and hash them together.
A MAC is a signature based on a secret key, providing similar assurances to a signature scheme based on public-key cryptography such as RSA-based schemes where the signature must have been produced by a principal in possession of the private key.
Cryptographic primitive | Hash | MAC | Digital Security Goal | | | signature ------------------------+------+-----------+------------- Integrity | Yes | Yes | Yes Authentication | No | Yes | Yes Non-repudiation | No | No | Yes ------------------------+------+-----------+------------- Kind of keys | none | symmetric | asymmetric | | keys | keys