I know Symmetric encryption systems. Can someone explain the difference

  • $\begingroup$ Symmetric keys can be used for HMAC algorithms to prove data integrity of a stream cipher ie AES-CTR, what do you mean by symmetric authentication? $\endgroup$
    – SamG101
    Commented Jan 19, 2020 at 19:13
  • $\begingroup$ @SamG101 I think they mean HMAC/CMAC etc $\endgroup$
    – Legorooj
    Commented Jan 19, 2020 at 22:25
  • $\begingroup$ Encryption aims at protecting confidentiality of some data, but does not necessarily provide authentication. Authentication aims at insuring that data comes from an authorized party and was not altered, but does not provide confidentiality. The concepts are orthogonal. The question is like asking what's the difference between a warm and a wear-resistant clothing. $\endgroup$
    – fgrieu
    Commented Jan 20, 2020 at 13:10

1 Answer 1


In order to prove data integrity - I think this is what you mean rather that symmetric authentication - you can use a symmetric key with HMAC/KMAC.

These are varieties of message authentication codes, and these specific varieties use hash algorithms - SHA2/3/SHAKE. I'll use the example of AES-CTR with HMAC. To generate keys for this, use the HKDF-Expand, to derive the AES and HMAC keys individually.

The HMAC should have the input as the AES cipher text, (there is a question that talks all about Encrypt-Then-Mac, Encrypt-And-Mac, Mac-Then-Encrypt if you're interested: Should we MAC-then-encrypt or encrypt-then-MAC? ) and the HMAC key used to produce the tag. The tag is sent along with the ciphertext.

The HMAC proves the integrity of the AES data, because when the ciphertext is received, the recipient produces the HMAC from the recieved ciphertext. If the newly computed tag matches the tag that was sent along with the ciphertext, then the data integrity has been verified. If the tags dont match, it is evident that someone has tampered with the ciphertext during transmit.

Bit of extra info: there are varieties of the MAC algorithms:

  • HMAC (Hash-based message authentication code)

  • KMAC (Keccak-based message authentication code)

  • CMAC (Cipher-based message authentication code)

  • OMAC (One-time message authentication code)

  • GMAC (Galois-based message authentication code)


Not the answer you're looking for? Browse other questions tagged or ask your own question.