# Is MAC better than digital signature?

MACs differ from digital signatures in the sense that MAC values are both generated and verified using a shares secret key. Does this in any way put MAC on a disadvantage as compared to digital signatures? How is one of them better than the other?

-

Was, as you stated, a MAC "are both generated and verified using a shared secret key", while with a digital signature, the signatures are generated with one key, and are verified with another (and it is infeasible to sign anything with the verifier key alone).

So, with digital signatures, we can give someone the ability to verify signatures, but not generate them; with a MAC, we cannot do so.

Is this difference important? Well, that depends entirely on what we're doing, and whether we can whether someone who can verify messages can also create them.

For example, consider the case of Alice sending messages to Bob. Bob wants to make sure those messages really come from Alice, and so they share keys; Alice signs/MACs the messages, and Bob verifies those messages. If that's the only what that key is used, we don't mind if Bob can also use his key to generate messages, because we can trust that he won't. After all, the only one who will ever validate a message is, in fact, Bob. If Bob does generate his own message, well, the only one he would be able to fool with it would be himself, and there's no point to that.

For an example in the other direction, consider the example of distributed stock quotes, where (say) the New York Stock Exchange publishes the current price of stocks. Now, people will need to be able to determine if these quotes came from NYSE, and so they need to be verifiable somehow. If these quotes were MACed, that means that NYSE would need to distribute the MAC secret key (so people can verify quotes); that would mean that someone could generate a fake stock quote (one that says that, say the price of GM just went drastically down); because he has the MAC secret key, he can compute the correct MAC, and that would fool someone else, causing them to dump all their GM stock. To prevent this, any such system would need to use a signature method, with the NYSE signature key being distributed. That way, anyone could validate a stock quote, but they wouldn't be able to generate fake quotes of their own.

Now, the next obvious question is "if a digital signature can do everything a MAC can do, why would we ever use a MAC"? Well, the answer is that while a digital signature could be used where we currently use a MAC, it is also much more expensive; a MAC is much (several orders of magnitude) cheaper to compute and verify, and is also somewhat shorter. No one uses a digital signature when a considerably cheaper MAC would do the job.

-
"while a digital signature could be used where we currently use a MAC" I disagree. One-to-one and one-to-many authentication are different operations, and can't easily substitute for each other. Often Alice doesn't want Bob to be able to prove to Carol what she said. – CodesInChaos Jul 16 '12 at 19:39
@CodeInChaos: if Bob had the private key, how would he prove to Carol that Alice signed the message, and not Bob? Remember, when you're using a signature as a MAC, you distribute both the private and the public key to everyone that would get the MAC secret key. – poncho Jul 16 '12 at 20:20
He wouldn't, he would instead give Carol the public key and not the private key. $\:$ (How much of $\hspace{0.6 in}$ an effect this possibility has depends on how difficult it would be to obfuscate MAC verification.) – Ricky Demer Jul 16 '12 at 22:37