---
title: "Message Authentication Codes"
slug: "dsm-message-authentication-codes"
updated: 2025-07-22T13:10:06Z
published: 2025-07-22T13:10:06Z
canonical: "support.fortanix.com/dsm-message-authentication-codes"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Message Authentication Codes

## 1.0 Overview

The Fortanix-Data-Security-Manager (DSM) can compute and verify Message Authentication Codes using symmetric keys.

## 2.0 Prerequisites

Computing and verifying MACs requires a Fortanix DSM account, a group with a symmetric key, and an application configured in that group. *For more information, refer to* *the* [*User's Guide: Getting Started with Fortanix Data Security Manager - UI*](/v1/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

## 3.0 Required Operations

The symmetric key must have the MacGenerate operation enabled for generating a MAC and the MacVerify operation enabled for verifying a MAC. In addition, the key must be enabled.

## 4.0 Authorization and Configuration

You must first authenticate and optionally configure a default API client as described in [*Configure API Client and Client Authentication*](/v1/docs/configure-api-client-and-client-authentication). Creating or verifying a MAC requires authenticating as an app with an API key or a client certificate. (User accounts cannot compute or verify MACs.)

## 5.0 Create a DigestApi Object

Computing and verifying MACs is performed using a DigestApi object.

```bash
import com.fortanix.sdkms.v1.api.DigestApi();

DigestApi digestApi = new DigestApi();
```

## 6.0 Compute a MAC

### 6.1 Create a MAC Generate Request.

The MAC request object encodes the request parameters. `alg` (algorithm) specifies the hash algorithm to use, and `data` specifies the data that the MAC is being calculated for. `data` should be binary data passed as a byte array.

```bash
import com.fortanix.sdkms.v1.model.MacGenerateRequest;

DigestRequest macRequest = new MacGenerateRequest().alg(DigestAlgorithm.<algorithm>).data(<data as byte[]>);
```

### 6.2 Make the Compute MAC Call

The MAC is calculated with the computeMac() method of the DigestApi object. The MAC is returned as a byte array in the digest property of a MacGenerateResponse object.

```bash
import com.fortanix.sdkms.v1.model.MacGenerateResponse;

MacGenerateResponse macResponse = digestApi.computeMac(<key UUID>, macRequest);
byte[] mac = macResponse.getDigest();
```

## 7.0 Verify a MAC

### 7.1 Create a MAC Verify Request

The MAC verify request object encodes the request parameters. `alg` (digest algorithm) specifies the hash algorithm to use. `data` specifies the data that is being verified, and should be passed as a byte array. `digest` specifies the computed MAC, and should also be passed as a byte array.

```bash
import com.fortanix.sdkms.v1.model.DigestAlgorithm;
import com.fortanix.sdkms.v1.model.MacVerifyRequest;

MacVerifyRequest verifyRequest = new MacVerifyRequest().alg(DigestAlgorithm.<algorithm>).data(<data as byte[]>).digest(<digest as byte[]>);
```

### 7.2 Make the Verify MAC Call

The MAC is verified with the verifyMac() method of the DigestApi object. The `result` property of the returned MacVerifyResponse object will be `true` if the MAC was successfully verified, and `false` if it did not verify.

```bash
import com.fortanix.sdkms.v1.model.MacVerifyResponse;

MacVerifyResponse verifyResponse = digestApi.verifyMac(<key UUID>, verifyRequest);
bool verified = verifyResponse.getResult();
```

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.