Let's assume Bob and Alice has a secret key for MAC. If MAC is constructed by the key and the message, that means that both Alice and Bob can construct the exact same message and MAC. So, Bob can claim Alice created certain message, not him. What's the point to use MAC then? Why not just use symmetric encryption?
$\begingroup$
$\endgroup$
Add a comment
|
3 Answers
$\begingroup$
$\endgroup$
Non-authenticated symmetric encryption schemes are generally malleable, meaning that an attacker who intercepts a message may be able to modify it even without knowing the key, e.g. by flipping arbitrary bits in it. A MAC prevents such attacks by detecting any modifications made to the ciphertext.
Also, there are various chosen-ciphertext attacks that work by having the attacker feed bogus ciphertexts to a recipient with the key and observing the responses (such as whether the ciphertext decoded to a valid message or not). A properly used MAC also prevents such attacks, since the attacker will not be able to generate messages that would pass the MAC check.
Finally, a MAC is also useful for detecting modifications to message metadata, which might otherwise allow replay attacks to be carried out.
Instead of combining a traditional symmetric encryption scheme with a MAC, it's also possible to use a purpose-built authenticated encryption scheme to achieve the same goals, sometimes more efficiently. That said, many authenticated encryption schemes actually consist of a traditional scheme combined with a MAC, although the combination may be done in specific ways that offer some speed, convenience or misuse-resistance advantages over the generic encrypt-then-MAC construction.
Ps. If you want to be able to prove that a given message was sent by Alice to Bob and not, say, forged by Bob himself, you need a digital signature instead of a MAC.
However, note that, for some applications, the inability to verify a MAC without knowing the shared key can actually be considered a feature, since it provides a measure of deniability — if you're Alice, and your supposedly private conversation with Bob is somehow leaked, a MAC cannot be used to prove that you actually wrote the leaked messages, since anyone who can verify the MAC could also forge it. In particular, the OTR messaging protocol uses MACs instead of signatures precisely for this reason.
answered Oct 20, 2013 at 18:28
$\begingroup$
$\endgroup$
Symmetric encryption alone doesn't provide a guarantee of integrity. A MAC guarantees that only someone who holds the secret key could have created the message.
If you're looking for non-repudiation (not being able to claim that anyone else created a particular message), then digital signatures are the cryptographic tool of choice.
$\begingroup$
$\endgroup$
You are asking a MAC to do something it was not intended to do. With a MAC, someone who knows the secret key can be assured that only someone who also knew the secret key sent the message. Thus, if Alice and Bob are the only people who know the key, and if Alice receives a MAC'ed message, she can be assured that only Bob could have sent it (because she knows it wasn't her).
A MAC is useless for proving anything to anyone who doesn't know the secret key. For that task, you need a digital signature. Also, as to why a MAC can't just be replaced by a symmetric encryption scheme -- for every ciphtertext there is a plaintext (unless we are talking about an authenticated encryption scheme). So creating a 'fake' plaintext is trivial -- you just create a random string and send that as the ciphertext. Of course, it's just going to decrypt to garbage (with overwhelming probability), but Alice won't be able to tell whether the garbage message is a fake or if Bob sent it, if they are just using symmetric encryption.
