0
$\begingroup$

Let's say I'm making a digital signature like this:

hash = hash(message)
digital signature = encrypt_with_private_key(hash)

where the private key is Alice's private key from a secure public-key cryptosystem.

And I'm making a MAC like this:

MAC = hash(message + some_secret_key)

And I then send both of these to my friend, encrypted using AES or some other cipher.

I feel I'm just creating work for him.

Could I simplify things like this?

MAC = hash(message + some_secret_key)
digital signature = encrypt_with_private_key(MAC)

Please tell me the pros and cons of this.

Improve this question
$\endgroup$
  • $\begingroup$ Hi kelalaka, yes, assume both my friend and I are using RSA and have shared public keys. Thanks. $\endgroup$ – if_dogs_could_swim Apr 28 '20 at 15:16
  • $\begingroup$ Are you sure you read my question? Line 3: digital signature = encrypt_with_private_key(hash). Surely that implies I'm doing things the normal way using asymmetric encryption? $\endgroup$ – if_dogs_could_swim Apr 28 '20 at 15:21
  • 2
    $\begingroup$ "encrypt_with_private_key" is a contradiction in terms. One never encrypts with a private key. A private key is used to sign or decipher, a public key.to verify or encrypt. There's seldom a good reason to sign a MAC. "MAC = hash(message + some_secret_key)" is a MAC with a less sound security argument than HMAC, as rightly pointed above. $\endgroup$ – fgrieu♦ Apr 28 '20 at 15:35
  • 3
    $\begingroup$ Why would your friend(s) need a MAC (and bother with the difficulty of safely storing the necessarily secret key that it requires) if they can check a signature? As a much lesser issue: if you have more than one friend using the scheme, why would they trust that you, rather than another of your friends, made the MAC ? $\endgroup$ – fgrieu♦ Apr 28 '20 at 16:14
  • 1
    $\begingroup$ Please read my Q/A about private key encryption != signature generation $\endgroup$ – Maarten Bodewes♦ Apr 30 '20 at 0:17
1
$\begingroup$

First of all, in a digital signature scheme that follows the hash-and-sign paradigm $Enc_{sk}(hash(m))$ the hash procedure is essential to "fit" the message $m$ in the public-key scheme domain: you cannot encrypt messages of any size with RSA for example.

The second important point is that a digital signature scheme is a bit closed to public-key encryption: because we consider an untrusted channel to communicate the public-key; another similarity is that the signer wants the signature to be publicly verifiable.

So, when we are using public-key cryptography, everything we do not want is to suppose a private/secure channel to exchange keys; you will need one if you want to use a cryptographic hash like a mac scheme. Furthermore, the signer has to exchange different secret keys with everyone who wants to verify the signature. Thus, creating distinct MAC tags: so, such a signature would no be publicly verifiable, but designated.

Another important point is that care must be taken when a cryptographic hash is chosen: HMAC wasn't designed considering collision attacks M. Bellare, New Proofs for NMAC and HMAC: Security without Collision-Resistance. So, if you don't have a collision resistant mac scheme, what if a adversary can find another $tag'_i=mac(m_i)$, after consulting a polynomial number of $m_i, tag_i, Enc_{sk}(tag_i = mac(m_i))$, and so forging a signature?

BTW, unforgeability is a cornerstone security property of digital signatures schemes.

Last but not least important. by using only a mac scheme and sharing key, we don't have non-repudiation or authentication. If the singer and verifier share a secret key, how can we prove which one created a tag? So mac isn't enough: you also need a public-key scheme.

Well...the pros... I can't see anyone. Sorry.

Improve this answer
$\endgroup$
0
$\begingroup$

you seem to have run into two sandtraps.

The first one is that signing is in some way related to encrypting with the private/secret part of the key, instead of the public part. As far as I know this assumption stems from RSA, which is the only asymmetric encryption scheme I know of that has this really weird property.

Signature and encryption schemes are entirely separate. They have different correctness goals, and different security requirements.

You can check out the corresponding chapters on these in the excellent "Introduction to Modern Cryptography"

The other one is that a MAC can be constructed by $\text{hash}(\text{key}\ \|\ \text{message})$. This has been proven faulty again and again by length extension attacks.

Additionally, you can rely on only the signature to obtain integrity and non-repudiation.

Best, ambiso

Improve this answer
$\endgroup$
  • $\begingroup$ They want non-repudiation, so just a MAC won't suffice. $\endgroup$ – Conrado Apr 29 '20 at 11:17
  • $\begingroup$ You're right, I skipped that part. I'll update the answer. $\endgroup$ – cisnjxqu Apr 30 '20 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.