What is the advantage of digital signatures over message authentication codes?

Question

Studying for CISSP these choices seemed limited:

What is the advantage of digital signatures over message authentication codes?

1. Digital Signature provides integrity verification while message authentication code does not
2. Digital Signature provides confidentiality while message authentication code does not
3. Digital Signatures provide authenticity while message authentication code does not
4. Digital Signatures works faster than message authentication codes

Using the following chart as a reference, I'm leaning towards #2, but none of the choices really fit properly…

Cryptographic primitive | Hash |    MAC    | Digital
Security Goal           |      |           | signature
------------------------+------+-----------+-------------
Integrity               |  Yes |    Yes    |   Yes
Authentication          |  No  |    Yes    |   Yes
Non-repudiation         |  No  |    No     |   Yes
------------------------+------+-----------+-------------
Kind of keys            | none | symmetric | asymmetric
                        |      |    keys   |    keys

Hopefully an expert here can clarify.

Answer 1

If this requires a single answer among 1/2/3/4 (rather than none), I would select 3, by the following reasoning:

2. Digital Signature provides confidentiality while message authentication code can not

We can summarily exclude this, since a Digital Signature simply does not provide confidentiality.

4. Digital Signatures works faster than message authentication codes

We can exclude this (slightly fixed) statement: Digital Signature is often annoyingly slower than MAC (an exception is long messages with the signature's hash supported by hardware and the MAC in software; but then we can hash then make a MAC of the hash to regain most of the speed). Digital Signatures also has larger minimum size overhead for equivalent resistance to brute force.

3. Digital Signatures provide authenticity while message authentication code cannot

Authenticity is commonly defined as only a user authorized to author or modify a message can do so. In some use cases, a MAC can provide authenticity (e.g. if the MAC key is kept secret, including unknown to users that verify integrity, by using Smart Cards to verify signed messages); but if we understand "while" as including in some setups where, the statement makes sense: the (only) advantage of Digital Signature over MAC is that verification is possible with only public keys; and that provides authenticity in many setups where a MAC does not (e.g. verification using a computer that adversaries can fully analyze).

1. Digital Signature provides integrity verification while message authentication code can not

Integrity is commonly defined as resisting accidental alterations, or the stronger resisting deliberate modifications by outsiders. Digital Signature and MAC both insure this. Other definitions similar to that of authenticity are sometime used, but if we have to choose between 1 and 3, we must pick 3.

Answer 2

First lets be precise on some definitions :

• Integrity = only the authorized users can modify the information.
• Confidentiality = only the authorized users can access the information. Here the information is in plain view.
• Authentication = Proof of the identity of the content/sender (sort of proof of identity), be sure to not mistake it with identification.

---

Signatures :

• are used for verifying public keys.
• guarantee non-repudiation
• possible public verification

MAC :

• very good performances (block-cipher...).
• secret key shared between two users (at least) $\implies$ no non-repudiation
• no public verification

Both of them provide integrity (and authentication). But none of them provide confidentiality : the information is in plain view.

Answer 3

One of the main differences is that Message Authentication Codes don't prove authorship of the message. Imagine the situation, when Bob sent a signed contract to Alice. In case of digital signature Alice can go to court claiming that Bob has signed the contract. A judge can verify the signature and make sure that the contract was really signed by Bob as only Bob knows the signing key.

If the contract was just MAC'ed, the MAC key is known by both parties (Alice and Bob). The judge can't verify that Alice isn't going to forge the contract as she also knows the MAC key.

So, I would choose point #3.

Answer 4

I'd choose 3 in the exam, but is not really correct

Should be written as (3) Digital signature provides non-repudiation property while message authentication code can not

Actually, authenticity is provided with MAC, but the difference is non-repudiation, as Artjom said in his answer