2
$\begingroup$

I found multiple posts regarding the differences between HMAC and RSA. Why should I prefer one or the other?

These are some examples:

HMAC SHA256 vs RSA SHA256 - which one to use

What are the different use cases between an HMAC and digital signature?

I am designing an SSO (single sign on) scheme to enable registration from one entity to a third party.

From my perspective HMAC should be used as we only want to check that the first entity is a known one. Furthermore HMAC can be faster than RSA (openssl speed hmac rsa gives 1 magnitude difference).

On the other hand, would it be better to use digital signatures to avoid risk case either of the two sides of the system is breached?

I have tried to look on many other schemes for similar use cases and it seems like almost everyone uses HMAC-SHA256. I am not sure if this risk is something should be considered as I couldn't find any crypto notes regarding this matter.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
4
$\begingroup$

HMAC (and any other MAC) are totally different from Digital Signatures (RSA, DSA, ECDSA, EdDSA).

MACs require a shared secret key that both the communicating parties have. The same secret is used to create the MAC as is used to verify it. Anyone with the shared secret key can create a MAC, and anyone with the shared secret key can verify a MAC.

Digital Signatures don't use a shared secret: Each entity has two keys, one public and one private. Only they can sign messages (only they have the private key) but anyone can verify those signatures. There's no need to exchange a shared secret.

MACs are generally much faster than Signatures.

That said, the fact that you are asking this question indicates that you have some fundamental learning to do before even starting to design an SSO mechanism. Have you considered using OAuth? There are many libraries for various languages that support it, it's secure, and it avoids many of the hidden pitfalls you won't have thought of.

Improve this answer
$\endgroup$
5
  • 4
    $\begingroup$ Also it should be noted that with MACs you cannot tell which of the owners of the shared keys has "signed" the message because they are using the same key. Signatures on the other hand can be associated with exactly one entity - the owner of the private key. $\endgroup$
    – grees
    Aug 12, 2019 at 5:40
  • $\begingroup$ Thank you for your answer, I'll just mention that I understand and know these differences between digital signatures and MAC. The thing is that regarding MAC, if only one side of the communication is signing, the fact that the other part can verify make the schema be more vulnerable to breach of the shared key, doesn't it? $\endgroup$
    – David Barda
    Aug 12, 2019 at 13:22
  • 1
    $\begingroup$ Yes, but breach of a secret or private key is always fatal. $\endgroup$
    – SAI Peregrinus
    Aug 12, 2019 at 19:25
  • 1
    $\begingroup$ Then shouldn't I minimize the risk and keep the secret only on the signing side(as in digital signature)? $\endgroup$
    – David Barda
    Aug 13, 2019 at 15:15
  • 1
    $\begingroup$ Yes, that's certainly a possibility. If that "minimizes the risk" however depends on the threat model for your particular system. E.g. if you only send signed messages in one direction then it doesn't matter if your secret key or private key gets compromised, as the function of the key is identical in both situations. Similarly, you may just be communicating between client and server, and only the client is at risk of losing the keys. $\endgroup$
    – Maarten Bodewes - on strike ♦
    Aug 13, 2019 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.