ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Hash-based Message Authentication Codes (HMACs) are calculated with a key that is shared between the sender and the receiver. Because both parties (and anyone who compromises the shared key) can generate a valid HMAC, the recipient cannot later prove to a third party which specific entity created the message. Therefore, an HMAC strongly protects message integrity and provides mutual authentication, but it does not provide non-repudiation. True non-repudiation requires an asymmetric mechanism-such as a digital signature-where only the sender possesses the private signing key. Options stating that HMAC supplies non-repudiation or confidentiality are incorrect. The claim that HMAC is inherently weak against replay attacks is also incorrect; replay protection depends on additional measures such as nonces or timestamps rather than on the HMAC algorithm itself.