Symmetric authentication scheme

This symmetry between senders and recipients is usually reflected in the system structure the schemes are then called symmetric authentication schemes (see Section 2.1). In contrast, digital signature schemes are sometimes called asymmetric authentication schemes. However, schemes exist that provide mere authentication and are not symmetric in this sense [OkOh91] (called non-transitive signature schemes there). 

A similar work for authentication schemes was only published 15 years later In [GiMS74], the information-theoretic, i.e., absolute security of symmetric authentication schemes was defined. Schemes complying with this definition are often called authentication codes. Like Claude Shannon s work, [GiMS74] already contains both concrete constructions of authentication codes and lower bounds on the achievable efficiency, and in particular, the key length. In contrast to secrecy schemes, however, the upper and lower bounds are not identical furthermore, the constructions are less trivial. Therefore, there has been further research in this field. 

Digital signature schemes have one more advantage over symmetric authentication schemes, besides allowing disputes to be settled Key distribution is simpler. 

The following schemes are in many respects similar to signature schemes, but have particular properties so that they do not correspond to the informal requirements on replacements for handwritten signatures from Chapter 1. Of course, this is no criticism, because most of these schemes were deliberately invented for other applications. The original names containing signature schemes were retained. In the literature, the word signature scheme was also sometimes applied to symmetric authentication schemes such schemes are not listed here. 

In practice, however, to this day, schemes with even greater efficiency are used for symmetric authentication, instead of information-theoretically secure ones schemes about whose security no precise knowledge exists. Most common are certain modes of operation of the (former) Data Encryption Standard (DES). (See, e.g., [DES77] for the standard, [DaPr89] for modes of operation and possible applications, and [BiSh93] for new security examinations.)... 

The restriction to computational security is not necessarily a serious objection to the use of asymmetric authentication, because, as mentioned, most symmetric schemes used in practice are not information-theoretically secure either, nor has their security been proved in any stricter sense. 

Logic specification of signature schemes may sound rather similar to the logics of authentication, often called BAN logic, from [BuAN90] and many subsequent articles. However, the purpose and consequently the approach are quite different. This is natural, because these logics were primarily designed to find errors in key-distribution protocols with symmetric schemes, which they do successfully. 

---