Generally digital signature is a public key cryptography concept.But it needs high overhead. So is there any publication or link available where 'digital signature using symmetric key' has been explained? Can one generate an algorithm combining the public key and private key of RSA algorithm to make it a symmetric key?

  • 5
    $\begingroup$ I don't get your question. What do you mean by symmetric key digital signature? A MAC? Or are you talking about an asymmetric scheme built from symmetric primitives (like hash signatures?) $\endgroup$ Commented Feb 23, 2014 at 9:24
  • 2
    $\begingroup$ It is what MACs are for. They allow you to authenticate a message with a shared secret. Keywords: MAC, HMAC, keyed hash function. $\endgroup$ Commented Feb 23, 2014 at 9:42
  • $\begingroup$ Read this blog article: blog.cryptographyengineering.com/2014/02/… $\endgroup$
    – xxxxxxxxx
    Commented Feb 24, 2014 at 7:22
  • $\begingroup$ In the last part, the paragraph, titled " Indistinguishability Obfuscation" it links a paper which uses obfuscation to turn private crypto into public. I have not read the paper entirely, but they seem to straight into the matter. $\endgroup$
    – xxxxxxxxx
    Commented Feb 24, 2014 at 7:23
  • 1
    $\begingroup$ Would Lamport signature fit? It's digital signature built from a hash, which is symmetric key cryptography. $\endgroup$
    – fgrieu
    Commented Nov 11, 2021 at 20:33

3 Answers 3


You may be interested in reading up on the The TESLA Broadcast Authentication Protocol which uses the one-way key chain concept to achieve authentication.

The basic idea of the key chain is to hash a secret key value repeatedly and use the hashes or "keys" in the reverse order for authentication. A simple example would be for Alice to compute

$$H(H(H(H(\text{secret key}))))$$

and send this value securely to Bob. Next, Alice disclose the value of

$$H(H(H(\text{secret key}))).$$

Since the hash function, H(.) is assumed to be one-way then any party with knowledge of the pre-image is assumed to be Alice.

The sender uses the most recent value from the one-way chain as a cryptographic key to compute a MAC. Each receiver can verify that the disclosed key is correct (using self-authentication and previously released keys). The authors state that any key of the key chain can serve as a key chain commitment and is similar to a public key of a digital signature


I have some thoughts about it. If two persons Alice and Bob are sharing secret symmetric key, which known only by them, then if Bob will send to Alice encrypted with key K, message M, it will be enough for proof that M was really created by Bob. Because only Bob knows secret key K, so only he could to encrypt message M with this key. Only one problem for Alice and Bob is how to share key K. So if this problem does not exist, than all public key cryptography would not be needed. But because all conversations between Alice and Bob can be modified by Man in the middle, they have no opportunity to exchange secret key K. And that is why they are using public key cryptography. Bob shared his public key and Alice can use it to proof is received message was created by him.

Regarding your question, you can use symmetric key K for proof that message was created by specific person(for example MAC), but for this you first need to share key. And for this you need to use public key or trusted Key distribution center(which is not as convenience as public key crypto).


Some of the most commonly used signatures are symmetric.

If two parties have a shared secret (a random value), then as a signature they can use the hash of the combination of the message and the key. To verify the signature, the other party generates their own signature for the message and then checks that both signatures match.

This is the principle of the HMAC-SHA256 signing algorithm used for most JSON Web Tokens, e.g. for OIDC authentication with federated online identity providers. It is also the basis of AWS SigV4 protocol, for signed requests used to authorise any control of resources across some of the largest cloud datacentres.

  • 1
    $\begingroup$ The term for your example is called "MAC" - message authentication code. While both MAC and DSS ensure authenticity and integrity, they're distinct. $\endgroup$
    – DannyNiu
    Commented Jan 6 at 10:42
  • $\begingroup$ @DannyNiu are you trying to make a semantic point? Obviously asymmetric signatures are different from HMACs, but HMACs are also widely referred to as "signatures" despite lacking asymmetry. (E.g. in any of the JWT specs, etc) $\endgroup$
    – benjimin
    Commented Jan 6 at 11:32
  • 1
    $\begingroup$ DSS has the property that verifiers cannot produce valid signatures due to them not having the private signing key, this is a key difference between DSS and MAC. The so-called "signature" produced by MAC algorithms are known as "tags". Also, HMAC isn't the only MAC out there. $\endgroup$
    – DannyNiu
    Commented Jan 6 at 12:47
  • 1
    $\begingroup$ Also, can you tell me how to sign a digital transaction using HMAC without others forging transactions against your will? This is a key functional difference between DSS and MAC. The article you linked is simplifying things, but sadly, it's causing some confusions obviously. $\endgroup$
    – DannyNiu
    Commented Jan 6 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.