I came across these functions m+EeA(H(m)) (for authentication without confidentiality) and m+H(m+k) (for authentication without encryption) and I'm having a bit of a difficult time understanding them. What are good usage examples for these functions?

I'm taking an information security course and these functions along with others were in the slides and I looked them up and that's what I got. I still don't have a clear idea about their usage and how they are supposed to provide security for the user.


First I'll have to say that the slides you were getting this information from are not of particularly good quality - to formulate it nicely.

What is called m+H(m+k) in the presentation can actually parsed as a poor attempt at providing symmetric message authentication. If you're not sure how to parse this, the second part is: Basically what is described here on Crypto. While it will be reasonably secure if you use a good hash function as H, it's not a good example on how to really do message authentication, which would be to not bother authenticating alone (rather using GCM or something like that) or to use HMAC, which has much stronger security properties than this construction at minimal overhead.

As for the application, there are TLS ciphersuites doing basically this: Not encrypting the message, but symmetrically authenticating it. The potential use cases are so rare that I can't actually think of any (but apparently there are some or otherwise there wouldn't be any cipher suites). As an abstruse example I could imagine that if a government has banned encryption (i.e. banned all encryption algorithms), this could be the highest security level you can get, it won't hide the message, but it will ensure it hasn't been tampered in transit.

The other function m+E_{eA}(H(m)) exploits the common missconception, that encrypting with the private key is equivalent to signing a digital message. It proposes to "encrypt the hash of the message using the private key eA" to sign the message m.

This actually has many practical applications. The first one is signing contracts, i.e. you want your signature to be authentic but don't care to hide the contents of the message (as is sometimes the case with contracts). Another one would be to authorize bank transactions, i.e. authorize payments of a large amount of money. This is usually only encountered in enterprise level payment. The last really important use-case is certificates. If a trusted party signs m=your_name+your_public_key, it binds this key to you, allowing people to use this key to contact you or to verify your signatures.


The first equation in your question represents a digital signature. There's a hash over the message, encrypted by the private key of the sender. Recipient (or anyone else) can decrypt using the sender's public key, and can determine, by re-computing the hash, that the message has not been altered.

The second is a keyed message authentication code. A hash is computed over the message and a key, k, shared between sender and recipient. The recipient uses his copy of k and the message to recompute the hash and compares the recomputed hash with that attached to the message.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.