Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have read the post Why should I use Authenticated Encryption instead of just encryption? When is it safe to not use authenticated encryption?

I assumed hard drive volume encryption or per file encryption that is not transmitted over an insecure network should be considered safe to do without a MAC. Is that right?

The advantage might be that if you do not provide a MAC, an attacker that has gained access to the physical storage and performing a brute force search does not know if they have successfully decrypted the volume/file as they do not have the MAC to verify that the key is correct. Perhaps an attacker could try decrypting and testing if decryption matches English phrases, however there could be multiple keys that produce valid plaintexts.

What is done in practice, do programs like TrueCrypt or Keepass perform authenticated encryption?

share|improve this question
5  
Long story short, when your threat model does not include an attacker with the ability to manipulate ciphertexts prior to decryption. –  Stephen Touset May 7 at 6:14

1 Answer 1

What Stephen says in the comment is correct. It is safe to not use authenticated encryption whenever your adversary model assumes that the attacker does not have the ability to manipulate ciphertexts.

I assumed hard drive volume encryption or per file encryption that is not transmitted over an insecure network should be considered safe to do without a MAC. Is that right?

What if the attacker can install a program on your machine that can modify the ciphertext? It all depends on adversary model.

The advantage might be that if you do not provide a MAC, an attacker that has gained access to the physical storage and performing a brute force search does not know if they have successfully decrypted the volume/file as they do not have the MAC to verify that the key is correct. Perhaps an attacker could try decrypting and testing if decryption matches English phrases, however there could be multiple keys that produce valid plaintexts.

In practice, for most applications, it will be pretty easy to know when they got the right key. But also, in practice, brute force is not the attack you should be worried about. Very rarely does the attacker attack the cryptography. They usually attack other pieces (password entry, key generation, key storage, side channels, etc) to render the crypto useless.

What is done in practice, do programs like TrueCrypt or Keepass perform authenticated encryption?

Truecrypt does not provide authenticity and integrity.

It looks like keepass does provide integrity protection, but I couldn't quickly find anything that says exactly how. See the relevant quote from here:

In repair mode, the integrity of the data is not checked (in order to rescue as much data as possible). When no integrity checks are performed, corrupted/malicious data might be incorporated into the database. Thus the repair functionality should only be used when there really is no other solution. If you use it, afterwards you should thoroughly check your whole database for corrupted/malicious data.

share|improve this answer
2  
We might note that Truecrypt's lack of authenticity and integrity is not because its authors believe no attacker could ever modify your ciphertext, but because Truecrypt is written with the constraint that the ciphertext not be any larger than the plaintext. –  Brock Hansen May 7 at 19:32
    
Why would they need the constraint that the ciphertext not be any larger than the plaintext @brock? –  user13435 May 8 at 3:59
1  
I have heard some users think its a good idea to put their files inside an encrypted TrueCrypt container then put the container on DropBox (or other cloud provider) so there is an additional layer of encryption if they do not trust the cloud provider. But that does not sound particularly safe because the cloud provider can modify your data or they could be forced to by NSA. So if TrueCrypt is not using authenticated encryption then that does not sound particularly safe. If a user attempts decryption with the modified data can malware e.g. BadBIOS potentially infect their machine? –  user13435 May 8 at 4:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.