Is there a symmetric-key algorithm which we can use for creating a signature?

Question

I know that in the asymmetric-key algorithm the RSA signature exists but what about the symmetrical ones?

Answer 1

Symmetric analogue of signatures. The symmetric analogue of a signature is variously called a message authentication code, MAC, or authenticator. The same key is used to create and verify authentication tags on messages.

Consequently, unlike signatures, third parties can't meaningfully verify MACs: if Alice sends a message with a MAC to Bob, Bob can't use the MAC to persuade Charlie that Alice sent the message because Bob could have created the MAC too.

Typical examples include HMAC-SHA256, keyed BLAKE2, KMAC128, AES-GMAC (which requires a distinct nonce for each message), and Poly1305 (which alone can be used only for one message per key). Authenticators are often combined with ciphers to make authenticated ciphers like crypto_secretbox_xsalsa20poly1305 or AES-GCM, which simultaneously prevent eavesdropping and forgery.

Signatures built out of hashes. You can also make a public-key signature scheme out of a collision-resistant hash function $H$, like SHA-256.

In the traditional one-time signature scheme of Lamport, you randomly generate a collection of 512 bit strings $x_{0,0}, x_{0,1}, \dots, x_{0,255}; x_{1,0}, x_{1,1}, \dots, x_{1,255}$, and publish $y_{b,i} = H(x_{b,i})$ as your public key. To sign the message $m$, let $b_i$ be the $i^{\mathit{th}}$ bit of $H(m)$; the signature is $x_{b_0,0}, x_{b_1,1}, \dots, x_{b_{255},255}$—that is, you reveal $x_{0,i}$ if the $i^{\mathit{th}}$ bit of $H(m)$ was zero, and $x_{1,i}$ if the $i^{\mathit{th}}$ bit was one. Anyone can verify this using your public key by checking whether $y_{b_i,i} = H(x_{b_i,i})$, but only you knew the preimages $x_{b_i,i}$ in advance.

Modern variants like SPHINCS extend this idea to many messages, and eliminate the need for collision resistance of $H$ in order to go faster.

There's no symmetric keys here but sometimes hashes are considered to fall into symmetric-key cryptography, since, e.g., the function $k \mapsto \operatorname{AES}_k(0)$ is supposed to be an irreversible hash.