# What is the difference between authenticating and signing a document?

Authenticating a document means to verify it is from the sender. But it seems like signing a document also verifies it’s from the sender. What exactly is the relationship or difference between “authenticating a document” and “signing a document”? Are they the same thing?

• One could authenticate with a MAC or an interactive protocol. $\;$ – user991 Apr 4 '14 at 18:15

## 4 Answers

Authentication can either mean entity authentication or data authentication.

Data authentication is a means to demonstrate that some specific data originates from a specific source and has not been modified during transmission and/or upon storage. It can be achieved by the use of digital signatures in a public key, i.e., asymmetric, setting or message authentication codes (MACS) in a secret key, i.e., symmetric, setting. Digital signatures support public verifiability and thus using the respective public key (which is assumed to be known by anyone) given the signature and the data anyone can check if the data has been authenticated by the holder of the corresponding private key. In contrast, using MACs only support private verifiability, i.e., only parties holding the respective secret key can verify whether a given data has been authenticated by any of the other parties holding the respective secret key.

Entity authentication is a means to prove to someone else that the entity it is speaking to is indeed the entity it is claiming to be. This can be achieved by various means such as challenge response authentication protocols (which may be based on digital signatures).

Often this is not explicitly stated, but it should be clear from the context what type of authentication one is referring to.

You sign a document with a signature. You authenticate a signature (thus proving the authenticity of the document).

With authentication, only the intended recipient can confirm the authenticity of the message. With signatures, everyone can.

To keep it simple:

• authentication = something to indicate the origin and authenticity of a document or message.
• signature = a form of identification in authorizing a document or message.

You can authenticate a document/message by “signing” it with a signature, or you can authenticate a document/message by authenticating the document/message itself (using a MAC or something alike).

Maybe this graphic can help you understand a bit better…

As the image shows, when you “sign” data (Signed-Data Type), you will be doing something different than when you “authenticate“ it with a MAC (Authenticated-Data Type). Nevertheless, both enable you to authenticate the related data… using different protocols.

• Re authentication, what in this frame gives receiver confidence of origin? Could someone read this frame, extract data (since it is plain text), modify it, generate a new key, make a MAC, and encrypt key for same receiver using receiver's public key? This seems to guarantee nothing. – philcolbourn Aug 5 '16 at 14:34
• @philcolbourn The question asked above, and which I answered here, was “What is the difference between authenticating and signing a document?” and if they are the same thing or not… the question was not about confidence or guarantees several types of authentication may or may not provide. Re-reading your comment, it seems as if you’ve got more of an individual question there – which you can ask here. – e-sushi Aug 5 '16 at 16:39
• I had a little rant didn't I. There is a 'consensus' in these answers and in general that 'authentication = something to indicate the origin and authenticity of a document or message.' If authentication indicated origin, as your answer states, then these graphics, whilst helpful and appreciated, need some text to explain how origin and authenticity are established. You say and show a difference, but OP states 'Authenticating a document means to verify it is from the sender' - is this right? Do you think I should turn my comment into a question? – philcolbourn Aug 7 '16 at 0:35