Why it matters
Hashes show up all over payment systems:
- certificate signatures;
- EMV offline data authentication;
- TR-34 key loading;
- PIN-less authentication schemes;
- API signatures;
- file integrity checks.
HMACs protect API calls and some host links. Knowing what each one proves, and what it does not, avoids designs that look secure and are not.