Is there a semantic difference between tagging AES_128/CTR/NoPadding ciphertext with a MAC (HmacSHA256) or Digital Signature (SHA256withRSA) when attempting to verify that the ciphertext has not been changed?

+-------------+
| Cipher Text |
+-------------+
| MAC         |
+-------------+


VS

+-------------+
| Cipher Text |
+-------------+
| Signature   |
+-------------+


Yes, there is an important one; The Non-Reputation;

Non-repudiation refers to a situation where a statement's author cannot successfully dispute its authorship or the validity of an associated contract

The HMAC key is a symmetric key therefore there is no non-repudiation. Both sides can not claim that the other side sends them the message $$m$$. I.e. They both can forge messages and claim that the other side sent them.

In the RSA case, the signer uses their private key and the receiver verifies it with the singer's public key. Therefore, the sender can not refute the message and this can be used as proof in the courts. This is the digital version of the physical signatures, signing a paper.

In other words, both have integrity and authentication however only public-keys have Non-Repudiation. HMAC (it is a MAC) protects against message forgery against an attacker who doesn't have the key. Public key protects against message forgery against all except the owner.

HMAC (MACs) RSA signature (PKCS signature)
Integrity Yes yes
Authentication Yes Yes
Non-Repuditiation No Yes
• However, a trusted third party could provide non-repudiation when using an HMAC key. Isn't that correct? Jan 23 '21 at 8:22
• @Patriot could you elaborate on the case? I've trust issues; the trusted third party may be a covert adversary against me. Note that when you have a trusted party mst of the problems solved, in real life, no! Jan 23 '21 at 8:34
• I did not mean to raise a quibble. It crossed my mind about the case of using of an HMAC with a one-time pad. A trusted third party could provide non-repudiation, but you are right about real-life application. Jan 23 '21 at 9:15
• I took it seriously, not considering it as a quibble. Are you saying, that the TTP provides a one-time-key for the sender to use with HMAC? Public-keyless old protocols. Of course, it will work, it is like a ticket for you to send messages. And, the TTP must store lots of keys, too. Jan 23 '21 at 9:25
• Yes, that is exactly it. Jan 23 '21 at 9:52