if two communicating parties share a (symmetric) session key, k.

When one of the party wants to send a message 'm' to other, is it okay use {m}k as a digital signature?

  • $\begingroup$ Who should verify? $\endgroup$
    – SEJPM
    Dec 8, 2015 at 21:03
  • $\begingroup$ Considering no third parties, because it's a symmetric key exchange. $\endgroup$ Dec 8, 2015 at 21:06

1 Answer 1


No. ​ Let || be concatenation, let [E',D'] be any symmetric encryption scheme,
and then let [E,D] be given by ​ ​ ​ E(k,x) ​ = ​ 0 || E'(k,x) ​ ​ ​ and
D(k,empty_string) = empty_string ​ ​ ​ and ​ ​ ​ D(k,0||c) = D'(k,c) ​ ​ ​ and ​ D'(k,1||c) = c .
The efficiency and correctness conditions for [E,D] are trivial. ​ Since E can be simulated
from E' by just prepending a zero to each ciphertext, [E,D] will be IND-CPA if [E',D'] is.
However, with [E,D], one can trivially break {m}k as an authentication
scheme by just outputting something that starts with 1.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.