4 ms·
A minor-ish clarification on terms: a MAC algorithm (e.g., hmac-sha1) should not be conflated with a digital signing algorithm (e.g., rsa-sha1), as the MAC requ
by sk5t 12y ago
A minor-ish clarification on terms: a MAC algorithm (e.g., hmac-sha1) should not be conflated with a digital signing algorithm (e.g., rsa-sha1), as the MAC requires knowing the secret in order to validate. MACs are fine for checking that data haven't been tampered with, but do not have the properties of an actual signature that you can verify without being able to reproduce.
- meowface 12y agoYep, absolutely. I said "a form of authentication" because it allows some degree of message authentication, but not to the same degree a proper digital signing mechanism that utilizes public key cryptography would. The term "signing" is also kind of overloaded, and doesn't necessarily mean signing in the sense of a human signature. HMAC-SHA1 and RSA-SHA1 (or PGP) both can be said to "sign" a message, but they mean different things. Generally for web app development, I think MACs tend to suffice for the vast majority of use cases.