Should the identity of a sender be verified using additional means, or does a MAC suffice? This question is aiming at clarification related to message authentication codes (MACs).

Wikipedia’s Message Authentication Code article states:


  In cryptography, a message authentication code (MAC), sometimes known as a tag, is a short piece of information used to authenticate a message—in other words,  to confirm that the message came  from the stated sender (its authenticity) and has not been changed.  The MAC value protects both a message's data integrity as well as its authenticity, by allowing verifiers (who also possess the secret key) to detect any changes to the message content.


(emphasis mine)

Is it correct to say that MACs not only provide integrity information related to the data itself, but also validate the identity of the originator? Or does it make sense to verify/validate the identity of a sender using additional cryptographic means – maybe something along the lines of a Sender Identification Code, Originator Verification Code, or something like that?

Differently asked:

Should the identity of a sender be verified using additional means, or does a MAC suffice?
It is a recurring topic: what exactly is identity and how to prove it ?  But related to your question: a MAC (correctly implemented) proves that the author of the message was in possession of the secret key (like you are, if you can verify it).  Now, depending on the application you have in mind, that's a good enough proxy of identity, or it isn't.

In other words, a MAC takes as assumption that you trust that only the right entities have knowledge of the secret key (you included), and then prove that the message could only have been signed by one of these entities.  The question of whether the right entity has the knowledge of the key is then another issue.