I know that in the asymmetric-key algorithm the RSA signature exists but what about the symmetrical ones?


1 Answer 1


Symmetric analogue of signatures. The symmetric analogue of a signature is variously called a message authentication code, MAC, or authenticator. The same key is used to create and verify authentication tags on messages.

Consequently, unlike signatures, third parties can't meaningfully verify MACs: if Alice sends a message with a MAC to Bob, Bob can't use the MAC to persuade Charlie that Alice sent the message because Bob could have created the MAC too.

Typical examples include HMAC-SHA256, keyed BLAKE2, KMAC128, AES-GMAC (which requires a distinct nonce for each message), and Poly1305 (which alone can be used only for one message per key). Authenticators are often combined with ciphers to make authenticated ciphers like crypto_secretbox_xsalsa20poly1305 or AES-GCM, which simultaneously prevent eavesdropping and forgery.

Signatures built out of hashes. You can also make a public-key signature scheme out of a collision-resistant hash function $H$, like SHA-256.

In the traditional one-time signature scheme of Lamport, you randomly generate a collection of 512 bit strings $x_{0,0}, x_{0,1}, \dots, x_{0,255}; x_{1,0}, x_{1,1}, \dots, x_{1,255}$, and publish $y_{b,i} = H(x_{b,i})$ as your public key. To sign the message $m$, let $b_i$ be the $i^{\mathit{th}}$ bit of $H(m)$; the signature is $x_{b_0,0}, x_{b_1,1}, \dots, x_{b_{255},255}$—that is, you reveal $x_{0,i}$ if the $i^{\mathit{th}}$ bit of $H(m)$ was zero, and $x_{1,i}$ if the $i^{\mathit{th}}$ bit was one. Anyone can verify this using your public key by checking whether $y_{b_i,i} = H(x_{b_i,i})$, but only you knew the preimages $x_{b_i,i}$ in advance.

Modern variants like SPHINCS extend this idea to many messages, and eliminate the need for collision resistance of $H$ in order to go faster.

There's no symmetric keys here but sometimes hashes are considered to fall into symmetric-key cryptography, since, e.g., the function $k \mapsto \operatorname{AES}_k(0)$ is supposed to be an irreversible hash.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.