§ 01
Definition
Defined in RFC 2104, HMAC wraps a hash function in a specific two-pass construction with the key. The result is a tag that anyone with the key can verify but no one without it can forge.
§ 02
How it works
In older VPN setups such as OpenVPN with AES-CBC, every packet carried an HMAC tag. OpenVPN's 'tls-auth' and 'tls-crypt' options also use HMAC on control packets so the server ignores anything not signed with a shared key, which helps against port scans and denial-of-service attempts.
§ 03
Why it matters
HMAC is still everywhere: in key derivation (HKDF), in IPsec, in TLS and in API authentication. In VPN marketing you may see 'HMAC SHA-256' in a spec sheet, which simply names the integrity check used.