System Administration Guide: Security Services

ProcedureHow to Compute a MAC of a File

A message authentication code, or MAC, computes a digest for the file and uses a secret key to further protect the digest. A MAC does not alter the original file.

  1. List the available mechanisms.

    % mac -l
    Algorithm       Keysize:  Min   Max
    des_mac                    64    64
    sha1_hmac                   8   512
    md5_hmac                    8   512
    sha256_hmac                 8   512
    sha384_hmac                 8  1024
    sha512_hmac                 8  1024
  2. Generate a symmetric key of the appropriate length.

    You have two options. You can provide a passphrase from which a key will be generated. Or you can provide a key.

    • If you provide a passphrase, you must store or remember the passphrase. If you store the passphrase online, the passphrase file should be readable only by you.

    • If you provide a key, it must be the correct size for the mechanism. For the procedure, see How to Generate a Symmetric Key by Using the dd Command.

  3. Create a MAC for a file.

    Provide a key and use a symmetric key algorithm with the mac command.

    % mac -v -a algorithm [ -k keyfile ] input-file

    Displays the output in the following format:

    algorithm (input-file) = mac
    -a algorithm

    Is the algorithm to use to compute the MAC. Type the algorithm as the algorithm appears in the output of the mac -l command.

    -k keyfile

    Is the file that contains a key of algorithm-specified length.


    Is the input file for the MAC.

Example 14–8 Computing a MAC With DES_MAC and a Passphrase

In the following example, the email attachment is authenticated with the DES_MAC mechanism and a key that is derived from a passphrase. The MAC listing is saved to a file. If the passphrase is stored in a file, the file should not be readable by anyone but the user.

% mac -v -a des_mac email.attach
Enter passphrase: <Type passphrase>
des_mac (email.attach) = dd27870a
% echo "des_mac (email.attach) = dd27870a" >> ~/desmac.daily.05.07

Example 14–9 Computing a MAC With MD5_HMAC and a Key File

In the following example, the email attachment is authenticated with the MD5_HMAC mechanism and a secret key. The MAC listing is saved to a file.

% mac -v -a md5_hmac -k $HOME/keyf/05.07.mack64 email.attach
md5_hmac (email.attach) = 02df6eb6c123ff25d78877eb1d55710c
% echo "md5_hmac (email.attach) = 02df6eb6c123ff25d78877eb1d55710c" \
>> ~/mac.daily.05.07

Example 14–10 Computing a MAC With SHA1_HMAC and a Key File

In the following example, the directory manifest is authenticated with the SHA1_HMAC mechanism and a secret key. The results are placed in a file.

% mac -v -a sha1_hmac \
-k $HOME/keyf/05.07.mack64 docs/* > $HOME/
% more ~/
sha1_hmac (docs/legal1) = 9b31536d3b3c0c6b25d653418db8e765e17fe07a
sha1_hmac (docs/legal2) = 865af61a3002f8a457462a428cdb1a88c1b51ff5
sha1_hmac (docs/legal3) = 076c944cb2528536c9aebd3b9fbe367e07b61dc7
sha1_hmac (docs/legal4) = 7aede27602ef6e4454748cbd3821e0152e45beb4