Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
The Wikipedia page on MAC calls the algorithm that is used to generate the MAC as a signing algorithm. Is that a fair use of that term? Can we then say that HMAC-SHA-1 uses SHA-1 as the signing algorithm?
Since the term signing algorithms is usually used in digital signatures that use asymmetric cryptography, won't this create confusion?
You misunderstood something. HMAC-SHA-1 does not use SHA-1 as the signing algorithm. The signing algorithm is the HMAC-SHA-1 calculation, not an intermediate SHA-1 calculation. The signing algorithm takes the key and the message as inputs and produces the MAC value as output.
The usual terminology for the hash algorithm that an HMAC construction uses is “underlying hash algorithm”. Note that having an underlying hash algorithm is not a universal property of MAC. For example CMAC has an underlying block cipher, but no underlying hash algorithm.
Asking whether it's “fair” to use a word is meaningless. There is no ethical consideration. The right question is whether it's potentially confusing — but terminology choices are to some extent arbitrary.
The single pair of words “encryption, decryption” is used both for symmetric and asymmetric encryption. Does it create confusion? Maybe, but not much, in my experience. Confusion stems from not understanding the concepts, not from the use of the same words for two related but different concepts.
There's no intrinsic reason why authenticity would require different words for symmetric and asymmetric cryptosystems, but confidentiality would be fine with the same words. It's just a historical accident. And ”verification“ is already used for both symmetric and asymmetric cryptosystems.
The only reason not to use “signature” for a MAC is that it's uncommon. In cryptography, “signature” almost always means an asymmetric signature cryptosystem, the signature operation of that cryptosystem, or the output of that signature operation (or the input of the verification operation). However, if the context of a symmetric system is established, there's no risk of confusion. In the context of a MAC, using the word “signature” to mean the calculation of the MAC value is unambiguous, and there isn't a really good alternative other than “MAC” itself (which also refers to the cryptosystem in general and to the value, so it is quite ambiguous).
So while “signature” for a MAC calculation is not well-established terminology, it should be. That would reduce confusion.
While this could be misleading, it is ultimately serving the same purpose here, just with a symmetric key instead of an asymmetric one. Just as an asymmetric signature provides proof of ownership of the private key, a MAC provides proof of ownership of the symmetric key.
Depending on how this key comes into existence this may provide varying levels of real-world identity mapping, but the same can be true of asymmetric cryptography. We often have this mapping precisely because there has been an independent verification of the ownership of that asymmetric key pair. In the event that a symmetric key has been set up to provide the same guarantee, the MAC is indeed serving as a signature.
