1
$\begingroup$

In my open source with offline client side encryption application, I plan to use AES-CTR or ChaCha20 without MAC instead of GCM or Poly1305 since:

  1. There is no database, the ciphertext, nonce, tag stored and encryption happened completely on the user's device, no need to verify authenticity or integrity with any API endpoint.

  2. Without MAC seems faster and less complicated

Is there any reason to choose MAC or AEAD in this case?

Improve this question
$\endgroup$
1
  • 4
    $\begingroup$ I've already answered this multiple times in your other question... Yes, you should use a MAC/AEAD to prevent an attacker from being able to modify the ciphertext and to prevent the ciphertext decrypting to gibberish when you use incorrect parameters. 'Faster and less complicated' is also not very accurate because AEADs are extremely fast and a decent cryptographic library results in an AEAD interface as difficult to use as an unauthenticated cipher (aka the tag is part of the ciphertext). $\endgroup$
    – samuel-lucas6
    Commented Sep 4, 2022 at 16:10

1 Answer 1

Reset to default
4
$\begingroup$

The goal of encryption is typically to provide at least privacy: that is, unauthorized parties should not be able to determine the contents of the message. If you assume that there is an unauthorized party that wants to read the message, that unauthorized party might also want to modify the message. AES-CTR is extremely vulnerable to this in that changing a bit in the ciphertext results in the corresponding bit changing in the plaintext.

Thus, you absolutely need a MAC or an AEAD, since your goal is presumably to properly secure the message. If you do not care about securing the message, then there is no need to encrypt it, either.

Using an AEAD in this case is extremely fast. AES-256-GCM on my laptop can encrypt at over 6.9 GB/s, AES-256-OCB can encrypt at over 9.6 GB/s, and even ChaCha20-Poly1305 can encrypt at 2.7 GB/s. ChaCha20-Poly1305 will perform better on machines without AES acceleration, and the other two will perform better on machines with AES acceleration. Assuming you properly verify the tag and use them in a secure way, all of these are solid, respectable choices for algorithms, and they can usually encrypt faster than you can write the data to disk or over the network, so performance is usually not a concern.

If you're going to encrypt or decrypt large amounts of data, you can simply use a chunked approach with a chunk counter in the additional data, and then use a standard cryptographic library like OpenSSL to do the encryption and decryption, which is secure and very easy to do.

Note that if you do not use a MAC or AEAD, then your software will contain a security vulnerability, and someone will likely issue a CVE for it, which you'll then need to address. Since you'll have to fix the problem then anyway, you might as well design a secure approach in the first place, which will be faster and easier than having to do it later on, and it will also make users have more confidence in your software.

Improve this answer
$\endgroup$
1
  • $\begingroup$ You are correct that performance is irrelevant. But you should perhaps mention the threat model. If the threat model is that nobody will access the computer unauthorised, you don't need encryption. If the threat model is the usual one, where tampering with the ciphertext is an acceptable adversarial goal, you need CCA security. Only if the threat model is that no adversary will be interested in modifying your plaintext, you can make do with CPA security. This may seem unlikely, I agree, and may have consequences if people disagree with the threat model chosen. $\endgroup$
    – K.G.
    Commented Sep 6, 2022 at 7:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.