Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I understand that both an HMAC and digital signature are used to check the integrity and authenticity of a message. Further, I understand that a digital signature is non-repudiatible.
What I do not understand is when to use an HMAC vs a digital signature, in practice. I appreciate the help!
Generally a digital signature is created using a private key and verified with the public key of an asymmetric key pair. Public keys can be easily distributed to verify the signatures.
It is however required that the public key can be trusted to be part of the correct key pair; the public key needs to be trusted. For this a public key infrastructure or PKI can be used. Probably the best known PKI is the PKIX infrastructure used by browsers. Here the public keys are part of X.509 certificates where the certificates are part of a trust chain. If such an infrastructure was not present then the attacker may have substituted a public key of his own key pair.
One thing that is not possible with signature generation is to sign with the public key. This is what allows the public key to be publicly distributed.
HMAC (which is just a specific MAC) is used with a single secret key, which is required for both the generation of the authentication tag (the MAC signature) and the verification of the tag. Anybody who has this key can therefore be a verifier and signer. The secret MAC key cannot be part of a PKI because of this.
Due to the issues with key distribution MAC schemes are either used by one party, or by a limited number of parties that have exchanged keys.
A MAC and signature algorithm can both be used for message authentication / integrity or entity authentication. However, due to the differences in how the keys are handled, MAC doesn't scale as well as a signature generation scheme.
On the other hand, symmetric algorithms are much more efficient than asymmetric ciphers, so if there is a choice then a MAC can be used to speed things up. A MAC is generally also more secure than a signature generation algorithm with regard to the key strength and resistance against quantum crypt-analysis.
As an example, in TLS 1.3 for HTTPS, entity authentication of the server is performed using a digital signature where the server has a private key and the client trusts a chain of certificates from a root CA to the certificate of the server.
However, the messages themselves are protected by a fast MAC - nowadays part of an authenticated cipher - after the session keys have been established. These session keys are - as the name implies - only used for the specific connection.
