Question

computer security

Question 2. Does message authentication imply user authentication? Is the opposite true? Explain your answer Message authentication is different from user authentication. Message authentication allows User authentication is used for access control and accountability.

Answer 1

In information security, message authentication or data origin authentication is a property that a message has not been modified while in transit (data integrity) and that the receiving party can verify the source of the message. Message authentication does not necessarily include the property of non-repudiation.

Message authentication is typically achieved by using message authentication codes (MACs), authenticated encryption (AE) or digital signatures. The message authentication code, also known as digital authenticator, is used as an integrity check based on a secret key shared by two parties to authenticate information transmitted between them. It is based on using a cryptographic hashor symmetric encryption algorithm. The authentication key is only shared by at least two parties or two communicating devices but it will fail in the existence of a third party since the algorithm will no longer be effective in detecting forgeries. In addition, the key must also be randomly generated to avoid its recovery through brute force searches and related key attacks designed to identify it from the messages transiting the medium.

Whereas, user authentication is the verification of an active human-to-machine transfer of credentials required for confirmation of a user’s authenticity; the term contrasts with machine authentication, which involves automated processes that do not require user input.

User authentication is performed in almost all human-to-computer interactions other than guest and automatically logged in accounts. Authentication authorizes human-to-machine interactions on both wired and wireless networks to enable access to networked and Internet connected systems and resources.

Hence, message authentication does not imply user authentication and the opposite is false too.