Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I want to check the integrity of some piece of data, I can check that a cryptographic hash of the data corresponds to a known hash.

Alternatively I can also check a digital signature on the data and see that it corresponds to a known authority for the data. I can use certificates or not for this.

I can also verify a MAC for the data using a secret key.

Lastly I can decrypt the data using an authenticating cipher mode using a secret key that is known only by me and the known authority for the data.

In these three cases I have some key or hash material. What is the word that correctly describes the material I have?

share|improve this question
Another way is to verify a MAC (which is not necessarily part of an authenticating cipher mode). $\hspace{.89 in}$ – Ricky Demer Mar 12 '14 at 12:09
True, I'll update the question. – user239558 Mar 12 '14 at 13:33

In the case of a digital signature, it was signed with a private key, and you are verifying it with the private key's public key the bits you are authenticating against are the input (encrypted or not) and the digital signature, which is an asymmetrically encrypted cryptographic hash of the input.

For an authenticating cipher mode such as OCB or GCM, the key is simply the cipher key, it is the same used for both authentication and encryption. GCM internally generates a Hash key that is the internal key that performs authentication, and is unique to each cipher key. Other dual key modes exist, in this case the key is generally called the MAC key. Most authenticating cipher modes also require a nonce to be unique and processed as part of either authentication or encryption (or both). The bits you are authenticating against are the inputs (encrypted or not, or both) and the authentication tag.

When using a MAC only construction such as CMAC (OMAC) or HMAC, the key is once again generally called the MAC key, the bits you are authenticating against are the input (encrypted or not) and the message authentication code.

MAC keys, depending on the algorithm, may further be broken down into subkeys, or may be one of the generated subkeys of a larger master key.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.