What security flaw exists (if any) in the solution of this non-encrypted authentication scenario?
An unencrypted message passes one-way from computer A to B. Its transmission is viewable by the public. The message does not need to be kept secret. Both A & B have already securely exchanged any needed keys. A and B keep their keys secret.
- B needs to authenticate that the message (10s to 1000s bytes) originated from A.
- Prevent others from creating a message (other than a copy that A originated) that B would mistake for an authentic message.
- A appends a MAC to the message and sends it. B receives purported message and MAC.
- B authenticates (or not) the message/MAC. MAC size: about 256 to 512 bits.
Looked over other Q&A, but authentication is so often tied with confidentiality that I failed to find posts that addressed authenticity without a secrecy requirement.
I selected the answer (1 of 2 good answers) that presented the original scenario’s biggest problem: Via comments, it came out that $B$ is really a set of clone $B$s and thus a MAC does not authenticate that the message came from $A$ as it could come from another $B$. Thus warranting a Digital Signature.
The following points shift the nature of the question but do align with the realities of my particular situation. There are mentioned here should additional answers wish to address the modifications - which I will review and likely up vote. I should post a new more clarified question later.
A1. My 1st goal s/b “$B$ needs to authenticate that the message (10s to 1000s bytes) originated from $A$ or from another $B$.” Thus a MAC appears still OK.
A2. Non-repudiation of a message is not needed.
A3. Each message is complete and is not part of a larger message set (ordering or selective blocking not an issue.)
A4. The size of the MAC (or alternatives) is limited.
Details: There is no wired network. The messages & MAC are contained in RFID tags. The message describes a product attached to an RFID tag. These messages are generated by $A$ "the factory" and distributed, via public means, to various $B$s. A given machine $B$ may alter the message either with the original MAC or with a new MAC unique to that $B$ machine - TBD. The product need not move between the clone $B$s. All this does not authenticate a valid product exists (the product and RFID tag could be separated or the RFID is spoofed). It does authenticate that a valid product’s message exists.