[jose] Proposed New Security Consideration for Algorithm Draft

["Jim Schaad" <[e-mail]>]

The following text should be added to the algorithm draft unless there is an
objection.  This will address the last piece of Issue #129 in the tracker.

 

Jim

 

 

Add new section 7.9

 

7.9  MACs vs Signatures for Security Properties

 

While in many cases MACs and Signatures can be used for integrity checking,
there are some significant differences between the security properties that
each of them provides and this needs to be taken into consideration when
designing protocols and selecting the algorithms to be used in protocols.

 

Both signatures and MACs provide for integrity checking, that is that the
message has not been modified since the integrity values was computed,
however MACs provide for origination identification only under specific
circumstances.  It can be assumed that a signature private key is in the
hands of a single entity (although perhaps a distributed entity in the case
of replicated servers), however for a MAC key it needs to be in the hands of
all the entities that use it for integrity computation and checking.  This
means that origination can only be assumed if a MAC key is known only to two
entities and the receiver knows that it did not create the message.  MAC
authentication cannot be used to prove anything to a third party.