English
Menu

Information Security Basics

Which statement correctly compares a message authentication code (MAC) with a digital signature?

  1. AA MAC can be verified by anyone with a public key, so its non-repudiation effect is stronger than that of a digital signature
  2. BA MAC is created with a symmetric key shared by the sender and receiver, so it can detect tampering, but because the receiver can also create the same MAC, it cannot provide non-repudiation, that is, prove to a third party that the sender created the message
  3. CA MAC just computes a hash value without a key, so even if an attacker alters the message and recomputes the MAC, the receiver can notice
Show answer and explanation

Answer: B. A MAC is created with a symmetric key shared by the sender and receiver, so it can detect tampering, but because the receiver can also create the same MAC, it cannot provide non-repudiation, that is, prove to a third party that the sender created the message

A message authentication code (MAC) is a short value computed from a message and a symmetric key; HMAC, which uses a hash function, is common. The receiver recomputes it with the same key and compares; if they match, the message came from someone who knows the key and was not altered on the way. An attacker who does not know the key cannot produce a correct MAC for an altered message. However, the receiver holds the same key and can also create MACs. The receiver therefore cannot prove to a third party that the sender created the message, so a MAC does not provide non-repudiation. A digital signature can be created only with the sender's private key and verified by anyone with the public key, so it can provide non-repudiation. MACs, on the other hand, are light to compute and widely used for checks between the two parties, such as detecting tampering in each packet of a connection. A plain hash value without a key can be recomputed by an attacker along with the altered message, so it cannot detect deliberate tampering.

  • A. Verifying a MAC requires the same symmetric key used to create it; it is not verified with a public key. Non-repudiation is a feature of digital signatures.
  • B. Correct. Using a symmetric key, it can detect tampering, but since the receiver can create the same MAC, it does not provide non-repudiation.
  • C. A MAC is computed with a symmetric key. A plain hash value without a key can be recomputed by an attacker, so tampering would go unnoticed.
Practice this topic Back to topic

Related calculators

Password Brute-Force Time CalculatorCompute the number of combinations and the entropy from the character set and length, and estimate brute-force time

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

More Information Security Basics questions

  1. It has been discovered that the private key corresponding to a web server's server certificate may have been leaked. The certificate has not yet expired. What is the most appropriate action for the operator?
  2. Of the three factors of authentication used to verify a user (knowledge, possession and inherence), which one applies to authentication with an employee ID smart card?
  3. Which of the following authentication methods is multi-factor authentication?
  4. In fingerprint-based biometric authentication, the threshold on the matching score required to accept a user as genuine is made stricter (higher). Which change generally occurs?
  5. A face recognition device can be set to one of three thresholds, A, B and C, with a false acceptance rate (FAR) and false rejection rate (FRR) of 1% and 0.5% for A, 0.1% and 2% for B, and 0.01% and 8% for C. For controlling entry to a laboratory, the requirement is a FAR of 0.1% or less, and within that, legitimate users should be rejected as rarely as possible. Which threshold should be chosen?