We're using the Objectivity/DB object database with a custom encryption plugin that encrypts serialized objects on disk. Encryption uses AES with a shared secret key held by all users. I would like to be able to provide some guidance to users if they enter the "wrong" shared encryption key (as in "I think you mistyped the encryption key. Please try again"). My first thought would be to use authenticated encryption to verify the decrypted data, but...

Because of constraints imposed by Objectivity/DB's storage manager, our encrypted data must be the same size as the unencrypted data, preventing us form using an authenticated encryption scheme. So, if the user supplies an incorrect shared key, the decrypted data is "gargabe", but is the right size and object references etc. point off to (often) segfault land. Thus, the user experience is a hard crash instead of a "oops, please retype your password". Not ideal.

Our current thinking is to store the HMAC of a known string (e.g. "This should decrypt"), encrypted using the shared secret key. We can test this hmac against the one produced with the users' key to verify the key is "correct" before continuing with deserialization of the unencrypted data from the database. Obviously this HMAC would have to be visible to anyone, before they make use of their secret key.

I'm concerned that this scheme exposes something that shouldn't be. Does using an HMAC in this way expose our encryption scheme (or worse, information about the shared key)?