Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that you can use for example CBC-MAC to verify data integrity and thus the password upon decryption.

But would there be security implications of just adding a constant string to the plaintext and if the first block is identical upon decryption we know the key was correct?

share|improve this question
Is the constant string supposedly known to all users (i.e., it is not a secret value known only to the communicating parties)? If so a padding oracle attack might be possible. – mikeazo Dec 1 '12 at 0:31

It likely depends on the encryption algorithm you use, but the answer is likely NO, this method does not ensure the integrity of ciphertexts.

For example, suppose you're using CBC mode encryption. The value you get for the first plaintext block when decrypting depends only on the first ciphertext block and the IV. Hence, I could intercept a message and change the ciphertext in any way I wanted as long as I kept these two values the same. The resulting, tampered-with ciphertext would pass your proposed integrity check.

However, if you really are only trying to make sure the key is correct (so a user can be informed if they entered a password incorrectly, for example), rather than trying to provide a secure MAC, then this method should work. Just be aware that it's not secure in the MAC sense.

Your scheme will not adversely affect the privacy of the encryption algorithm, as long as the encryption algorithm is secure against chosen-plaintext attacks. All standard encryption algorithms, such as CBC, meet this requirement (as long as they're used with a secure blockcipher, such as AES).

In summary, your scheme (1) will not alert you if a third party tampers with a ciphertext (whereas CBC-MAC would); (2) will almost certainly succeed in letting users know if they're using the correct key; (3) will not compromise the security of the encryption algorithm.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.