Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to provide access to encrypted data through a cloud service provider, using a pay-as-you-go model. This means that we will sometimes need to revoke a user's access to the data. To restrict a revoked user's access, the CSP will re-encrypt the data and send the new key to valid users only through their mail.

Before using the new key they received by mail, however, the users will presumably need some way to verify its integrity and authenticity. If possible, I would like to implement this using only symmetric encryption (like AES) instead of asymmetric encryption like RSA. Is this possible, and if so, how?

share|improve this question
Hi, nalini, and welcome to Crypto Stack Exchange. I've edited your question to hopefully make it easier to read, but there's always a chance that I might have made some mistakes while doing so. Please take a look at the edited text to see if it still matches what you meant to ask, and if not, please edit it yourself to correct any mistakes. Thanks! – Ilmari Karonen Dec 24 '15 at 8:16
You're going to re-encrypt the data? I think you may be missing a bit of cryptographic background if that's really what you are proposing. – Maarten Bodewes Dec 24 '15 at 11:27

Unfortunately, symmetric encryption do not provide integrity and digital signature functions. This is because symmetric encryption uses the same key for exncryption and decryption. This means that any who owns the decryption key can alter the data and no one will notice that the data is altered, because the same key was used for encryption.

This means that data integrity can be provided only by using asymmetric cryptography.

share|improve this answer
Or use a symmetric encryption model that van be verified using a MAC. This still requires a separate key for authentication but one van at least use a AES like key. – Yorick de Wid Dec 24 '15 at 9:31

Well, yes, this is possible, but not without an initial setup phase. You can use an authentication key at the server. You then distribute each client a derived key using some kind of ID of the client. This key needs to be distributed in a secure fashion to the client (this is the setup phase).

When you change the data encryption keys you create an authentication tag / MAC (e.g. using HMAC) for the encryption key. You can even wrap the encryption key with the key used by the client so the client cannot use the key without also verifying it (e.g. by using GCM or SIV mode encryption). Well, technically they can simply ignore the verification, but that would take effort.

Note that symmetric schemes are substantially more brittle than ones based on asymmetric cryptography.

share|improve this answer
OK, I'm off celebrating X-mas. Replies may not be quickly forthcoming the next 2 days or so. – Maarten Bodewes Dec 24 '15 at 11:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.