if two communicating parties share a (symmetric) session key, k.
When one of the party wants to send a message 'm' to other, is it okay use {m}k as a digital signature?
$\begingroup$
$\endgroup$
2
-
$\begingroup$ Who should verify? $\endgroup$– SEJPMDec 8, 2015 at 21:03
-
$\begingroup$ Considering no third parties, because it's a symmetric key exchange. $\endgroup$– ramailo sathiDec 8, 2015 at 21:06
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
No. Let || be concatenation, let [E',D'] be any symmetric encryption scheme,
and then let [E,D] be given by E(k,x) = 0 || E'(k,x) and
D(k,empty_string) = empty_string and D(k,0||c) = D'(k,c) and D'(k,1||c) = c .
The efficiency and correctness conditions for [E,D] are trivial. Since E can be simulated
from E' by just prepending a zero to each ciphertext, [E,D] will be IND-CPA if [E',D'] is.
However, with [E,D], one can trivially break {m}k as an authentication
scheme by just outputting something that starts with 1.