Is there a technical difference between tag such as tag generated by authenticated encryption, and signature such as the signature generated by a functional signature scheme or homomorphic signature scheme.


2 Answers 2


Suppose Alice and Bob are having a conversation, and they share a secret key $k$. Alice can put an authentication tag on every message she sends, and Bob can verify the authentication tag, using the key $k$. This is good enough to convince Bob that the message came from Alice (or someone Alice authorized), because only Alice and Bob share the secret key $k$.

But suppose Alice said something incriminating, say $m$ with authentication tag $t$. And suppose Bob wanted to convince a skeptical and impartial judge Jamal that Alice might be a terrorist.

  • Bob could show Jamal the authenticated message $(m, t)$—but that on its own would not be convincing to Jamal, because Jamal can't verify the tag $t$ on $m$ without the secret key $k$.
  • Bob could share $k$ with Jamal, but then he just proves he could have made up the incriminating message $m$ and computed the tag $t$ on it himself using the secret key $k$, in order to frame Alice.

With authentication tags, the power to verify a message is the same as the power to forge a message. Authentication tags are generally extremely cheap to compute—with universal hashes like Poly1305 they are some of the fastest cryptographic primitives ever—and small (say, 128 bits long), and are useful for conversations between two parties, but they are not useful for audit trails.

In contrast, suppose Alice signed the incriminating message $m$ giving a signature $\sigma$ with a public key $A$ that was printed in the telephone book long before this exchange. Then not only can Bob verify the signature $\sigma$ on the message $m$ using Alice's public key $A$, but anyone on the planet can do the same, including Jamal. So, unless Alice can convince Jamal that Bob (or perhaps some unscrupulous media mogul like Rupert Murdoch) got his hands on her private key corresponding to the public key $A$, the signature $\sigma$ is itself convincing evidence that Alice sent the incriminating message $m$.

Public-key signature schemes enable you to separate the power to verify a message from the power to sign a message. But there is a cost: usually signing or verifying messages is expensive, and public keys or signatures may be much larger than secret keys or authenticators. So signatures are useful for audit trails and third-party verifiability. (Of course, you may not want third-party verifiability!)


The authentication tag is the output parameter, like in AES-GCM, which is generated by the symmetric key to authenticate the message.

$$(c,tag) = \operatorname{AES-GCM-Enc}(key,m,IV,AD)$$

Where $A$ is the Associated Data. The tag is verified by the same key, IV, and AD.

$$(\{T,F\},m?) = \operatorname{AES-GCM-Dec}(key,c,IV,tag,AD)$$ The tag verification must be performed before using the plaintext.

A signature, digital signature, is created by using the asymmetric encryption mechanisms using the private key. Such as DSA, ECDSA, EdDSA, or RSA signatures. The digital signature can only be created by the private key owner, and it can be verified by anyone who knows your public key. The secure hashing mechanism is an integral part of secure signatures not due to signing small messages.

$$\text{signature} = \operatorname{Sign}(k_{prv}, m)$$

$$ \{T,F\}\stackrel{?}{=} \operatorname{Verify}(\text{signature},k_{pub},m)$$

So the distinction is; the tag is generated by the symmetric key and the signature is generated by private-key.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.