I found multiple posts regarding the differences between HMAC and RSA. Why should I prefer one or the other?
These are some examples:
HMAC SHA256 vs RSA SHA256 - which one to use
What are the different use cases between an HMAC and digital signature?
I am designing an SSO (single sign on) scheme to enable registration from one entity to a third party.
From my perspective HMAC should be used as we only want to check that the first entity is a known one. Furthermore HMAC can be faster than RSA (openssl speed hmac rsa
gives 1 magnitude difference).
On the other hand, would it be better to use digital signatures to avoid risk case either of the two sides of the system is breached?
I have tried to look on many other schemes for similar use cases and it seems like almost everyone uses HMAC-SHA256. I am not sure if this risk is something should be considered as I couldn't find any crypto notes regarding this matter.