thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Fundamentals & Crypto

HMAC vs Digital Signature: What's the Difference?

Both prove integrity and authenticity, but HMAC uses a shared symmetric secret while a digital signature uses an asymmetric private key. Only a digital signature provides non-repudiation, because with HMAC either party could have created the tag.

vs

Digital Signature

Full definition
HMACDigital Signature
Key typeShared symmetric secretPrivate key to sign, public key to verify
IntegrityYesYes
AuthenticityYes, between parties sharing the keyYes, tied to the private key holder
Non-repudiationNoYes
SpeedVery fastSlower
Common useAPI request signing, TLS record integrity, JWT HS256Code signing, email signing, documents, JWT RS256/ES256
Remember it

Shared key, shared blame: HMAC cannot prove which party sent it.

Exam tip

When a question asks for non-repudiation, eliminate HMAC and MACs. When it asks for fast integrity between two systems that already share a key, HMAC is the fit.

Tested on

More Security Fundamentals & Crypto look-alikes