Can a Message Authenticaty Code recover original data from corrupted data?

I am new to cryptography and have been studying for Dan Boneh's Stanford Course on Coursera, after going through encrytpion and decryption I've started the integrity portion of the Course.

Sir brought up MACs and how they use a key to ensure that data is not tampered. If my understanding is correct, data that is known to a hacker/eavesdropper(say the bootstrap in a windows 10 device) is kept secure since the system has a private key that can verify the data with it's own private key. That under ideal circumstances, the correct message would yield the correct tag and corrupted data would not, therefore any tampered with data would not fool the system(lack of better words).

Is my understanding correct so far?

Coming to the crux of my question, let's say that someone has used an XOR gate with one of the inputs as some random noise, the original data would get altered to some other data set. Is such a case possible if the authentication system is poorly designed? And if it is possible, how would the system get back the original data?

• For symmetric keys it is generally better to talk about secret keys. If you share a key value between sender and a receiver then obviously it is not private. Personally I sometimes wonder if professors are too smart to see the blindingly obvious, so this may be wrong in your textbook as well :) Oct 29 '18 at 17:51
• @MaartenBodewes not too sure that I got what you mean Oct 31 '18 at 14:05
• You are talking about a symmetric algorithm, a MAC, with private keys. As both the signing and verifying party need the same key it cannot be private because that would imply that only one party knows the key. It must remain secret to any adversary though. Stop it is beter to talk about secret keys for symmetric algorithms. Oct 31 '18 at 14:59

let's say that someone has used an XOR gate with one of the inputs as some random noise, the original data would get altered to some other data set. Is such a case possible if the authentication system is poorly designed?

If you change the message $$m$$ than the MAC will have a different value. Let see HMAC, fips-198-1;

$$MAC(m) = HMAC(K, m) = H((K_0 \oplus opad )|| H((K_0 \oplus ipad) || m))$$

Let say you modified even a single bit of $$m$$, now we have $$m'$$

Concentrate on this part; $$H((K_0 \oplus ipad) || m'))$$, and the $$H$$ is an approved Hash function, means that finding a collision is negligible. We assume that you have access to the keys\$.

In any case, when you modify the message $$m$$ to $$m'$$ with x-oring, you have to find a collision, i.e; $$H((K_0 \oplus ipad) || m'))=H((K_0 \oplus ipad) || m))$$

Finding collision is very hard, and if you find you will be very famous as in SHA-1, that still require $$2^{63}$$ calculations.

And if it is possible, how would the system get back the original data?

If a message is changed and there is no a MAC failure, there is no way to turn back to old value, except file history etc in your operating system.

Even there is a MAC failure, you cannot turn back to the original data. MAC's are not Error Correction Codes.

In a better short wording from Maarten's Comment;

a MAC is there to make the message tamper evident rather than tamper proof

• Thanks. I think I finally get the scope of a MAC, it is not so much insurance against a tampering of data, but a warning that Data has been altered Oct 29 '18 at 16:53
• @Mr.JohnnyDoe The active attackers modify, so we are looking ways to protection against modifications. Oct 29 '18 at 16:58
• ahhh, that makes sense. With encryption we want to keep passive attackers from eavesdropping. Here we look to keep active attackers from modifying data. On a side note, what should I be doing to try and do a project in a crypto field under a college professor? Oct 29 '18 at 17:04
• WRT the tampering, you could say a MAC is there to make the message tamper evident rather than tamper proof. Oct 29 '18 at 17:49
• tamper evident. That's an interesting way to put it Oct 31 '18 at 14:05