Authenticating a document means to verify it is from the sender. But it seems like signing a document also verifies it’s from the sender. What exactly is the relationship or difference between “authenticating a document” and “signing a document”? Are they the same thing?
Authentication can either mean entity authentication or data authentication.
Data authentication is a means to demonstrate that some specific data originates from a specific source and has not been modified during transmission and/or upon storage. It can be achieved by the use of digital signatures in a public key, i.e., asymmetric, setting or message authentication codes (MACS) in a secret key, i.e., symmetric, setting. Digital signatures support public verifiability and thus using the respective public key (which is assumed to be known by anyone) given the signature and the data anyone can check if the data has been authenticated by the holder of the corresponding private key. In contrast, using MACs only support private verifiability, i.e., only parties holding the respective secret key can verify whether a given data has been authenticated by any of the other parties holding the respective secret key.
Entity authentication is a means to prove to someone else that the entity it is speaking to is indeed the entity it is claiming to be. This can be achieved by various means such as challenge response authentication protocols (which may be based on digital signatures).
Often this is not explicitly stated, but it should be clear from the context what type of authentication one is referring to.
You sign a document with a signature. You authenticate a signature (thus proving the authenticity of the document).
With authentication, only the intended recipient can confirm the authenticity of the message. With signatures, everyone can.
To keep it simple:
- authentication = something to indicate the origin and authenticity of a document or message.
- signature = a form of identification in authorizing a document or message.
You can authenticate a document/message by “signing” it with a signature, or you can authenticate a document/message by authenticating the document/message itself (using a MAC or something alike).
Maybe this graphic can help you understand a bit better…
As the image shows, when you “sign” data (Signed-Data Type), you will be doing something different than when you “authenticate“ it with a MAC (Authenticated-Data Type). Nevertheless, both enable you to authenticate the related data… using different protocols.