if two communicating parties share a (symmetric) session key, k.
When one of the party wants to send a message 'm' to other, is it okay use {m}k as a digital signature?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this communityif two communicating parties share a (symmetric) session key, k.
When one of the party wants to send a message 'm' to other, is it okay use {m}k as a digital signature?
No. Let || be concatenation, let [E',D'] be any symmetric encryption scheme,
and then let [E,D] be given by E(k,x) = 0 || E'(k,x) and
D(k,empty_string) = empty_string and D(k,0||c) = D'(k,c) and D'(k,1||c) = c .
The efficiency and correctness conditions for [E,D] are trivial. Since E can be simulated
from E' by just prepending a zero to each ciphertext, [E,D] will be IND-CPA if [E',D'] is.
However, with [E,D], one can trivially break {m}k as an authentication
scheme by just outputting something that starts with 1.