Should I use distinct MACs for each user, or should I use a *direction* flag when communicating? Alice and Bob want to communicate using a stream cipher. At the beggining, they create a session key $K_s$ and exchange it via some secure channel (using some asymmetric algorithm). After every message, they want to append a MAC value to verify their identity.

The question is this:

Should I have a direction flag $D_a$ and send

$$ C:=Enc(D_a, M) || MAC_{K_S}$$

or generate a new key $K_a$ for each participant (for a total of 3 keys in my example) and send

$$ C:=Enc(M) || MAC_{K_a}$$

The second scheme looks more solid to me, assuming static direction flags. Intuitively I believe the two schemes are equivalent if the flags change after each message. Is this correct?



Notes:


When I say they exchange a key what I mean is they agree on some seed and use it to generate a pseudo-random stream using a PRF. For a long enough seed (32 bytes) and periodic re-seedings, I do not see anything wrong with this but any comments would be appreciated.
The encryption method is $C_i:=S_i \oplus M_i$ for some stream $S$.
For two participants generating the same stream, one uses every odd $S_i$ and the other every even $S_i$.
Either method is fine.  They're both secure.  You can use whichever feels more convenient, given your application setting.

Better yet -- don't try to design this kind of thing yourself.  Instead, use an existing scheme for providing a secure channel abstraction (e.g., TLS).