2
$\begingroup$

Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (SHA256withRSA) when attempting to verify that the ciphertext has not been changed?

+-------------+
| Cipher Text |
+-------------+
| MAC         |
+-------------+

VS

+-------------+
| Cipher Text |
+-------------+
| Signature   |
+-------------+
Improve this question
$\endgroup$

1 Answer 1

Reset to default
8
$\begingroup$

Yes, there is an important one; The Non-Repudiation;

Non-repudiation refers to a situation where a statement's author cannot successfully dispute its authorship or the validity of an associated contract

The HMAC key is a symmetric key therefore there is no non-repudiation. Both sides can not claim that the other side sends them the message $m$. I.e. They both can forge messages and claim that the other side sent them.

In the RSA case, the signer uses their private key and the receiver verifies it with the singer's public key. Therefore, the sender can not refute the message and this can be used as proof in the courts. This is the digital version of the physical signatures, signing a paper.

In other words, both have integrity and authentication however only public-keys have Non-Repudiation. HMAC (it is a MAC) protects against message forgery against an attacker who doesn't have the key. Public key protects against message forgery against all except the owner.

HMAC (MACs) RSA signature (PKCS signature)
Integrity Yes yes
Authentication Yes Yes
Non-Repuditiation No Yes
Improve this answer
$\endgroup$
7
  • 1
    $\begingroup$ However, a trusted third party could provide non-repudiation when using an HMAC key. Isn't that correct? $\endgroup$
    – Patriot
    Jan 23, 2021 at 8:22
  • 1
    $\begingroup$ @Patriot could you elaborate on the case? I've trust issues; the trusted third party may be a covert adversary against me. Note that when you have a trusted party mst of the problems solved, in real life, no! $\endgroup$
    – kelalaka
    Jan 23, 2021 at 8:34
  • $\begingroup$ I did not mean to raise a quibble. It crossed my mind about the case of using of an HMAC with a one-time pad. A trusted third party could provide non-repudiation, but you are right about real-life application. $\endgroup$
    – Patriot
    Jan 23, 2021 at 9:15
  • $\begingroup$ I took it seriously, not considering it as a quibble. Are you saying, that the TTP provides a one-time-key for the sender to use with HMAC? Public-keyless old protocols. Of course, it will work, it is like a ticket for you to send messages. And, the TTP must store lots of keys, too. $\endgroup$
    – kelalaka
    Jan 23, 2021 at 9:25
  • $\begingroup$ Yes, that is exactly it. $\endgroup$
    – Patriot
    Jan 23, 2021 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.