The service can generate and verify hash-based message authentication codes (HMAC) over data submitted by a user with a managed symmetric key, so that the MAC key never leaves the service.
Message Authentication Code Generation and Verification
CCC.KeyMgmt.CP26
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.TH07 | Signing or MAC Key is Used to Authenticate Unauthorized Content | Permission to invoke sign or MAC operations may be granted more broadly than intended, or a signing key may be reachable from a compromised workload. Signatures or authentication codes are then produced over content the key owner did not approve, and verifiers accept that content as genuine. Integrity of the code, tokens, or messages that trust the key is compromised, and the key owner cannot distinguish forged artifacts from legitimate ones. |