Which security service (confidentiality, data integrity, or partner authenticity) can each of these mechanisms provide: symmetric encryption, asymmetric encryption, Diffie-Hellman key exchange, hybrid encryption, MAC, digital signature, challenge-response with a MAC, challenge-response with a signature?
All four encryption-type mechanisms give confidentiality; MAC and signature give data integrity; only the challenge-response protocols give partner authenticity; Diffie-Hellman by itself gives none of the three.
| Mechanism | Confidentiality | Data integrity | Partner authenticity |
|---|---|---|---|
| Symmetric encryption | yes | ||
| Asymmetric encryption | yes | ||
| Hybrid encryption | yes | ||
| Diffie-Hellman key exchange | |||
| MAC | yes | ||
| Digital signature | yes | ||
| Challenge-response with MAC | yes | ||
| Challenge-response with signature | yes |
Why Diffie-Hellman gets no tick: it only produces a shared secret. It encrypts nothing, protects no message, and without authentication it does not even tell you who you share the key with (hence the man-in-the-middle attack).
Why MAC and signature are not "partner authenticity": they prove that a message is unaltered and came from the key holder (data authenticity). Authenticating a partner who is present right now needs a fresh challenge, otherwise an old authenticated message could simply be replayed. A challenge-response protocol builds exactly that on top of a MAC or a signature.
Exam trap: encryption never gives integrity. An attacker can flip ciphertext bits without knowing the key.