New answers tagged

0

This approach protects A and B from an external attacker who might want to mess with the message. However, it does not protect A from B or B from A. For example, A can craft a message and claim that it came from B since B is the only entity that shares this particular key with A. This property (called non-repudiation) is not unconditionally an advantage, ...


0

Usually symmetric crypto is preferred thanks to its efficiency compared with public key crypto. Its primitives are faster compared with those in public key encryption. There is is of course a tradeoff in key management: How users share their secret key in a symmetric setting? Asymmetric encryption solves this problem with the assumption of a trusted PKI, or ...


7

MACs have some advantages over digital signatures The component of the computational cost that is independent of message size is much higher for digital signatures, to the point of being an obstacle and requiring milliseconds or/and dedicated hardware. We know no signature scheme where both signature and verification of short messages are of speed any ...


-2

Public keys may not have been exchanged yet between A and B (maybe all they have at that point is a pre-shared secret).


10

There are many advantages of MAC's over signatures. For signatures you need to use asymmetric key pairs. Public keys need to be trusted for this to work. Unfortunately establishing trust is not that easy. Furthermore you don't want to use a private key stored on, for instance, a smart card (which would require a PIN and would likely be too slow). Instead ...


4

Can someone quote a protocol, application, etc, where the disadvantages of the MAC relative to digital signatures can be ignored? Your particular attack is of no interest if B has nothing to gain to claim that it got message M from A. As for concrete examples: the TLS record format, IPsec, SSH, the IES public key system; actually, any protocol that ...



Top 50 recent answers are included