I know Symmetric encryption systems. Can someone explain the difference

  • $\begingroup$ Symmetric keys can be used for HMAC algorithms to prove data integrity of a stream cipher ie AES-CTR, what do you mean by symmetric authentication? $\endgroup$ – SamG101 Jan 19 '20 at 19:13
  • $\begingroup$ @SamG101 I think they mean HMAC/CMAC etc $\endgroup$ – Legorooj Jan 19 '20 at 22:25
  • $\begingroup$ Encryption aims at protecting confidentiality of some data, but does not necessarily provide authentication. Authentication aims at insuring that data comes from an authorized party and was not altered, but does not provide confidentiality. The concepts are orthogonal. The question is like asking what's the difference between a warm and a wear-resistant clothing. $\endgroup$ – fgrieu Jan 20 '20 at 13:10

In order to prove data integrity - I think this is what you mean rather that symmetric authentication - you can use a symmetric key with HMAC/KMAC.

These are varieties of message authentication codes, and these specific varieties use hash algorithms - SHA2/3/SHAKE. I'll use the example of AES-CTR with HMAC. To generate keys for this, use the HKDF-Expand, to derive the AES and HMAC keys individually.

The HMAC should have the input as the AES cipher text, (there is a question that talks all about Encrypt-Then-Mac, Encrypt-And-Mac, Mac-Then-Encrypt if you're interested: Should we MAC-then-encrypt or encrypt-then-MAC? ) and the HMAC key used to produce the tag. The tag is sent along with the ciphertext.

The HMAC proves the integrity of the AES data, because when the ciphertext is received, the recipient produces the HMAC from the recieved ciphertext. If the newly computed tag matches the tag that was sent along with the ciphertext, then the data integrity has been verified. If the tags dont match, it is evident that someone has tampered with the ciphertext during transmit.

Bit of extra info: there are varieties of the MAC algorithms:

  • HMAC (Hash-based message authentication code)

  • KMAC (Keccak-based message authentication code)

  • CMAC (Cipher-based message authentication code)

  • OMAC (One-time message authentication code)

  • GMAC (Galois-based message authentication code)


Symmetric encryption is where you encrypt and decrypt with the same secret key. AES (Advanced Encryption Standard) is the most common symmetric encryption algorithm.

As for "Symmetric Authentication Systems", I don't know what you mean by that. I can guess as to that you mean using symmetric encryption to authenticate users of some sort.
When visiting stack exchange (or any other https:// website), your browser negotiates a secure connection with the server so that you both have the same symmetric key (Read More). Then data may be transmitted securely as both sides have the same secret key, while attackers do not. To learn more about secure key exchange, try googling "Diffie-Hellman key exchange".


Not the answer you're looking for? Browse other questions tagged or ask your own question.