I wonder how secure the HMAC is going to be if I use a public key verified data. HMAC suggests its key must be secret. I want to authenticate a set of blocks to be certain that each of them isn't tampered. No need for AEAD, where some methods exist. Or should I just go with simple digest?

I didn't try anything yet, I just want to know if it's worth looking in that direction.


1 Answer 1


I wonder how secure the HMAC is going to be if I use a public key verified data.

With HMAC, anyone with access to the key is able to generate the correct tag to any message he wants. If the key is public, well, that means anyone is able to generate HMAC tags.

Also, AEAD has the same issue; anyone with the AEAD keys can encrypt anything they want.

What does this mean? If you are only worried about accidental modifications, then HMAC with a public key is fine (although not any better than a straight hash; a CRC may work out better in this scenario - a CRC will catch short burst errors with 100% probability, and that is a common accidental modification).

On the other hand, if you have to have a public key and still have security, you're probably looking at a full signature system, where you have separate public and private keys. This is assuming that the reason you want to make the key public is so that anyone can verify.

Knowledge of the private key allows you to generate valid tags (known as signatures in this context); knowledge of the public key allows you to verify the tags (but not generate any valid tags to new messages), hence if this is the situation you're in, this is the natural solution. You'd publish the public key and keep the private key secret.

Of course, public key signature systems come with a cost; the tags (signatures) are larger, and they are more costly to implement (both in the signing and the verification; those become two different operations).

  • $\begingroup$ that's what i thought ☹️ $\endgroup$ Apr 17 at 17:43
  • $\begingroup$ to add: signing is over the public data hash $\endgroup$ Apr 17 at 17:44
  • $\begingroup$ Kind of. Signing includes the hash function as a configuration parameter. For API's I'd very much like if they'd accept a pre-calculated hash though, so it is possible to start hashing without having received the public key in advance. $\endgroup$
    – Maarten Bodewes
    Apr 18 at 20:17
  • $\begingroup$ @MaartenBodewes: you're in luck (at least, in terms of Dilithium, Sphincs+); it appears that NIST will explicitly support signing a hash (term: prehash); they make sure that doing so doesn't give a trivial existential forgery (by stirring in the fact that you're doing prehashing and what that hash function is into the signature) $\endgroup$
    – poncho
    Apr 18 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.