MAC providing sender authentication (follow up question)

Question

I was looking at the responses posted on the following question: How is digital signature different from a message authentication code (MAC)?

I read the following comment to the first answer:

So simply speaking, MAC cannot be used to verify sender authentication because it only protects the message integrity. Alright, thank you so much

This triggered a question, what if the key used for the MAC came from an authenticated key agreement?

Both parties would have been able to verify the public keys of each other during the key exchange. So this means that all derived keys from that key agreement are implicitly also authenticated. Meaning that the calculated MAC tags using that key provide message authentication and also provide sender authenticity. And can't seem to find something wrong with this logic.

A second question, is there a security reason why then not to use the public and private key pair to calculate digital signatures on the messages? Instead of using the MAC?

Answer 1

The statement you copied from the other question is incorrect. A MAC does authenticate a message (would be a rather stupid name, otherwise). If you have verified a MAC, you can be sure that the message was sent by anyone knowing the secret key. This is slightly weaker than the authentication done by a digital signature, because there are usually more parties in possession of the key.

This triggered a question, what if the key used for the MAC came from an authenticated key agreement? [...]

Your logic is correct. That is exactly what most secure network protocols (like TLS or SSH) do.

A second question, is there a security reason why then not to use the public and private key pair to calculate digital signatures on the messages? Instead of using the MAC?

That has performance reasons. Public Key operations are slower, need more memory and the output size is larger, compared to their symmetric counterparts.