2
$\begingroup$

I (believe I) am aware of the general difference between a hash and a MAC; the former is used for integrity and the latter for integrity and authentication as it also takes a secret key as an input in addition to the message.

But what if I hash the message, encrypt it using the secret key (one that is separate from the one used to encrypt the message), and send that instead of the MAC? Does it not hold the same properties as sending a MAC?

In both cases, we input a message and a secret key to compute an encrypted hash / MAC, so it seems like both integrity and authenticity are provided.

If not, in what way would an adversary be able to break the authenticity of a scheme that sends, along with each encrypted message, an encrypted hash (using a separate secret key)?

Edit:

As mentioned in a comment below, this has already been answered here and here but I am unable to mark it as a duplicate as it is on a separate StackExchange.

Improve this question
$\endgroup$
3
  • $\begingroup$ Are you talking about E[k1](m) || E[k2](H(m))? $\endgroup$ – forest May 6 '18 at 3:11
  • $\begingroup$ @forest Yes I am. $\endgroup$ – aanrv May 6 '18 at 3:13
  • $\begingroup$ Now that the question was migrated I just went ahead and "accepted" the duplicate-proposal you gave in the question body, as Squeamish Ossifrage talks precisely about the scheme you want in his answer there :) $\endgroup$ – SEJPM♦ May 6 '18 at 17:02
2
$\begingroup$

Assuming you mean EK1(m) || EK2(H(m)) or EK(m || H(m)), it is not an approved MAC scheme in any standards and may have issues. Instead, you should probably use an HMAC, which involves taking the message and the key and hashing them together. An HMAC is defined by RFC 2104 as HMACK(m) = H((K ⊕ opad) || H((K ⊕ ipad) || m)) where opad and ipad are constants. An HMAC is a keyed hash function, which means the digest depends on both the message and the key.

Improve this answer
$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.