Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send to a variety of approved recipients. I know I should also use some sort of authentication mechanism so the recipient can verify the integrity of the original message, but I'm not sure how best to go about doing this. It seems that I can do this by prepending a MAC of the message to the message. How is signing the message with a CA signed certificate different? Do they accomplish the same thing or are they used for different use cases entirely? Does this change if I use AES-256-GCM instead?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

The main difference between a MAC and a digital signature is that with a MAC, the same key is used to generate the MAC value and to verify it; whereas with a signature, distinct keys are used. In a signature, the generation key and the verification key are mathematically linked together, but it is not feasible to recompute the generation key from the verification key -- which is why the verification key can be made public while the generation key is kept private.

Signatures are for asymmetric situations, where the people who can verify signatures should not be given the power to generate signatures. If this feature is not needed in your system, then a MAC will be simpler.

Combining MAC and encryption, or a signature and encryption, is not easy (you can easily do something which works, but not easily do something which is secure). So you are encouraged to rely on an already thought-out protocol which does the job -- especially if you are "new to security". For synchronous data transfers, use SSL/TLS. For asynchronous communications (such as emails), use OpenPGP. Opensource implementations of both already exist in many languages. The protocol which is easiest to design and implement securely is the protocol which has already been designed and securely implemented by someone else.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.