TLS Finished message: is it MAC or HMAC In several academic literature, the term Finished MACs is used frequently. I wonder, is it really a MAC or HMAC? I am looking at literature in TLS 1.2 vs. TLS 1.2 specs. The specs of TLS 1.2 Finished messages Here says:
   Structure of this message:


  struct {
      opaque verify_data[verify_data_length];
  } Finished;

  verify_data
     PRF(master_secret, finished_label, Hash(handshake_messages))
        [0..verify_data_length-1];

  finished_label
     For Finished messages sent by the client, the string
     "client finished".  For Finished messages sent by the server,
     the string "server finished".



As far as I know, if PFR are used, then it is HMAC not a MAC. Can you clarify to me please: 

1) In TLS, is it Finished MACs or Finished HMACs? when some literature uses Finished MACs, is it correct (i.e. is it acceptable abbreviaton)?

2) Is it correct to use MAC instead of HMAc for short?
Is it correct to use MAC instead of HMAC for short?


In general, no.
MAC is a much more general concept than HMAC and thus such an equivalence in saying is clearly inacceptable. However, if you are talking about a specific protocol which authenticates its payload, saying "the MAC" to designate the MAC algorithm or the tag for messages, even if they use HMAC, is fully acceptable, because you are referring to the use of the more general concept with the concrete instantiation here.



Now to answer the question in the title (which will also catch question #1):


  TLS Finished message: is it MAC or HMAC?


The answer is both.
Yes, HMAC is always used here to compute the (correct) PRF value, which is only possible if the same transcript was seen and the same master_secret was generated. Thus the authentication is built-in.

However, prior to this message, the ChangeCipherSpec message was sent for the record-layer protocol, enabling the use of the negotiated cipher suite. So the Finished message is actually send using the (now) encrypted and authenticated record-layer protocol, which does use the MAC specified in the cipher suite (e.g. GMAC or Poly1305).

The relevant quote from the RFC is:


  The ChangeCipherSpec message is sent during the handshake after the
  security parameters have been agreed upon, but before the verifying
  Finished message is sent.