1
$\begingroup$

Does message authentication authenticate the entity?

If the answer is "No", because message authentications like MAC work with the shared symmetric key, then my second question is:

Does a message authentication using an asymmetric key like the digital signature enable both entity and message authentication?

If the answer is yes:

Is it arguable to say that message authentication using asymmetric key provides both entity and message authentication?

$\endgroup$
4
$\begingroup$

Message authentication (sometimes called data origin authentication) is the assurance that a given entity was the original source of the received data.

Entity authentication (or user authentication) is the assurance that a given entity is involved and currently active in a communication session. [1]

A MAC provides data origin authentication as the receiver knows that the message and corresponding MAC could have only come from the one person with the shared key. Used on its own, a MAC will not give you entity authentication.

A digital signature also provides data origin authentication as the verifier knows that only the owner of the private key could have produced a valid signature. Used on its own, a digital signature will not give you entity authentication.

You mention a shared symmetric key and whether or not a security service is provided. You are likely confused with non-repudiation.

Non-repudiation is the assurance that an entity cannot deny a previous commitment or action.[1]

If there is a shared key (such as in the MAC setting) one user could deny having produced a MAC tag on the message as the key is shared- external parties are not sure which owner of the MAC key could have produced the tag. Whereas with digital signatures, each key is unique to each user, so there is non-repudiation as only one user could produce a valid signature.

Used naively, neither MACs nor signature provide entity authentication as signatures/MAC tags could be forwarded or replayed. Recall: message authentication provides assurance on the original source and does not tell us anything about when the message was sent or who is sending it now.

Consider the following scenario with data origin authentication but no entity authentication: Alice could sign a message and send the message and signature to Bob. Bob could then forward the message and signature to Charlie, who can verify that the original source of the signature was Alice (as there is message authentication) but not that they are communicating with Alice now. Hence there is no entity authentication.

To get entity authentication, we need some kind of freshness. For example, for Charlie to be assured about Bob's identity and current activity, Charlie could request Bob produce a valid signature on a fresh nonce, generated by Charlie. This ensures that Bob is currently active and that the signature came from him. Obviously, this may be vulnerable to man in the middle attacks (Bob could forward the none to Alice to sign, and return the signature to Charlie), but there are things that can be done about this (for example, by asking Bob to sign the challenge along with a session ID: the session ID is unlikely to be the same as the session between Bob and Alice, so Alice would not sign).

In general, think of entity authentication as data origin authentication + freshness.

[1] Reference: Everyday Cryptography, 2nd Edition by Keith Martin (2018).

$\endgroup$
  • $\begingroup$ Thanks for the valuable comment, so is wrong to say that digital signature doesn't do entity authentication ? or should it be rephrased as, digital signature doesn't guarantee entity authentication? $\endgroup$ – Praveen David Mathew Jan 2 at 16:37
  • $\begingroup$ @kelalaka The three definitions of data origin authentication, entity authentication and non-repudiation are copy and pasted from the book. All the other text is mine. I have put citation marks round the quotes, please let me know if I need to do more. $\endgroup$ – arthurmilton Jan 3 at 16:16
  • $\begingroup$ @PraveenDavidMathew It is wrong to say that digital signatures alone provide entity authentication. It wold be correct to say that digital signatures do not guarantee entity authentication, but can be used along with freshness to provide it. $\endgroup$ – arthurmilton Jan 3 at 16:18
  • $\begingroup$ I've added the footnote as the references. Please check that is correct. $\endgroup$ – kelalaka Jan 3 at 16:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.