Page 439 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

rules to help keep these concepts straight in your mind when
preparing for the CISSP exam:

If you want to encrypt a message, use the recipient’s public key.

If you want to decrypt a message sent to you, use your private
key.

If you want to digitally sign a message you are sending to
someone else, use your private key.

If you want to verify the signature on a message sent by
someone else, use the sender’s public key.

These four rules are the core principles of public key cryptography

and digital signatures. If you understand each of them, you’re off to
a great start!

HMAC can be combined with any standard message digest generation

algorithm, such as SHA-3, by using a shared secret key. Therefore,
only communicating parties who know the key can generate or verify
the digital signature. If the recipient decrypts the message digest but
cannot successfully compare it to a message digest generated from the
plaintext message, that means the message was altered in transit.

Because HMAC relies on a shared secret key, it does not provide any

nonrepudiation functionality (as previously mentioned). However, it
operates in a more efficient manner than the digital signature
standard described in the following section and may be suitable for
applications in which symmetric key cryptography is appropriate. In
short, it represents a halfway point between unencrypted use of a
message digest algorithm and computationally expensive digital

signature algorithms based on public key cryptography.

Digital Signature Standard

The National Institute of Standards and Technology specifies the
digital signature algorithms acceptable for federal government use in
Federal Information Processing Standard (FIPS) 186-4, also known as

the Digital Signature Standard (DSS). This document specifies that all
federally approved digital signature algorithms must use the SHA-3