# Should I use distinct MACs for each user, or should I use a *direction* flag when communicating?

Alice and Bob want to communicate using a stream cipher. At the beggining, they create a session key $K_s$ and exchange it via some secure channel (using some asymmetric algorithm). After every message, they want to append a MAC value to verify their identity.

The question is this:

Should I have a direction flag $D_a$ and send

$$C:=Enc(D_a, M) || MAC_{K_S}$$

or generate a new key $K_a$ for each participant (for a total of 3 keys in my example) and send

$$C:=Enc(M) || MAC_{K_a}$$

The second scheme looks more solid to me, assuming static direction flags. Intuitively I believe the two schemes are equivalent if the flags change after each message. Is this correct?

Notes:

• When I say they exchange a key what I mean is they agree on some seed and use it to generate a pseudo-random stream using a PRF. For a long enough seed (32 bytes) and periodic re-seedings, I do not see anything wrong with this but any comments would be appreciated.

• The encryption method is $C_i:=S_i \oplus M_i$ for some stream $S$.

• For two participants generating the same stream, one uses every odd $S_i$ and the other every even $S_i$.

• I think you mean 32 byte seed, but you forgot the nonce in the scheme, which would eliminate the need for direction flags if there is no nonce overlap between parties – Richie Frame Sep 8 '13 at 20:43
• You're right about the seed length, sorry about that. Correcting now. About the nonce, where I present the alternative equivalent if the flags change after each message, that's what I mean so you've partly answered the question. Poor wording on my part. Cheers @RichieFrame – rath Sep 8 '13 at 20:48

• Ah, the obligatory "don't roll your own crypto". It's more of an excersise for me to play with mlock() and family but getting familiar with OpenSSL would be a good excersise as well. Cheers – rath Sep 9 '13 at 1:57