This was a question on an exam:

Two persons are using a one way communication channel and the HMAC functionality (concretely HMAC-SHA1). Choose the correct statement below:

1) We can prove who the sender is, because HMAC-SHA1 uses a shared secret, which is known to both of them. Even more, the communication channel only works in one way.

2) We can prove who the sender is, because HMAC-SHA1 uses a shared secret, which is known to both of them.

3) The sender can deny that he sent the messagge, because confidentiality wasn't provided.

4) Nothing of the above.

The questions on this exam are known to be tricky. I'm thinking answer 3 or 4 is correct ( you need a digital signature to provide non-repudiation and confidentiality has nothing to do with non-repudiation), but am leaning towards the fourth answer.

Which one would you choose?


Answer 2 is nonsensical; it literally says "we can prove who the sender is because two people have the ability to create the MAC." With a MAC, either party could have created the MACed message; each party knows who created it (you know if you wrote something or not, and if you didn't the other guy did), but they can't prove that to anyone else, nor can they prove they didn't create it after the fact. To do that, they'd have to be able to prove you sent the text over the channel (including some proof it couldn't have been tampered with in transit, say by someone person 2 gave the HMAC key to), but if they could do that they might as well skip the HMAC and say "he sent it, here's proof he sent it."

The one-way channel would mean anything sent over the channel didn't come from person 2. However, you'd have to prove the message you present was in fact sent over the channel, and that no one could send a faked message over the channel (say, after person 2 had given them the HMAC key). If someone sends you something over a channel where it's verifiable that it went over that channel and only they could send something over the channel, and both these things can be proven, that channel again provides non-repudiation without needing the HMAC.

The shared element between these is that two parties can create valid HMACs, and one is trying to prove the other created a particular one. That's like having two people who have identical signature stamps, with one trying to prove the other is the one who stamped something. A MAC by itself can't help with non-repudiation, because either party can create them, leaving you needing to prove that someone is in fact the one who made a particular MAC, which is no easier than showing they made the message in the first place. So answers 1 and 2 are not right; the shared secret is why HMAC can't effectively provide this. (digital signatures, in contrast, don't involve both parties being able to create them, so they're better at providing non-repudiation). (note: non-repudiation isn't actually a technical concept, and courts often accept s/My Full Name/ as a signature on electronic documents; HMACs might in fact convince someone enough to trust the person claiming you wrote something, even if they don't technically prevent them from forging it).

Answer 3 is indeed wrong; confidentiality isn't needed for non-repudiation. One of the best sources of non-repudiation is a declaration in open court; the non-confidentiality is part of the reason why that provides non-repudiation (i.e. everyone can access the records).

By process of elimination, the answer is 4.


I would say 2.

The reason: Theres 2 types of non-repudiation: One that you can prove to others, and one that you cannot.

There is schemes out there that are specifically made to prevent the possibility to prove to someone else that X sent it. Its called non-transferable PGP signatures, and goes on this way:

You hash the message with a MAC, using a random k. Then you sign the random k with your private key, and the encrypt it with the recipients public key.

This means the receiver are able to prove (to himself) that the sender sent the message since the receiver know he didnt write the message itself, preventing man-in-the-middle forgery. But since also the receiver knows the MAC key, and he must also reveal the MAC key to the verifier, he cannot prove to others what the sender did send, because he could aswell create that message itself.

In this case, both parties already have a shared key, so a key Exchange using a signed, encrypted random k is not neccessary. You could aswell run with HMAC directly on the shared key. But the same principle applies, that the receiver can prove to himself that sender sent the message, gaining non-repudiation this way, but he cannot prove to others that he sent the message.

But the mentioned MAC scheme does not gain non-repudiation to others, you cannot prove to other people that somone sent something.

  • I've never heard of non-repudiation meaning just "the receiver knows the message was from you," which allows for it to be nontransferable. In every security usage I've seen of the term, the whole point is that it is transferable, and it can be used against the signer (e.g. in court). What you're talking about, making sure the communication parties know the message hasn't been tampered with, is authenticity; nonrepudiation is going further and making sure you can't later deny having said something, which implies that I can prove you did, which requires it to be transferable. – cpast Jan 17 '15 at 2:18

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.