Confidentiality vs authenticity
Encryption aims at transmitting a secret message, maintaining it's confidentiality. It does not necessarily provide integrity or authenticity. That it to say, even with proper encryption, it might be possible to alter the encrypted message without that alteration being detected by the receiver.
That matters in many practical situations because adversaries (including Murphy's law) can alter encrypted messages:
- Even if the decrypted plaintext is nonsense, that could still be an issue, e.g. crash a computer system, which might be enough to cause harm, perhaps serve the interest of an attacker.
- Knowing that Alice sent to her Banker the order
Transfer $10 to Carol using a stream cipher like AES-CTR, or the One Time Pad (which perform secure encryption), it is easy to alter the encrypted message so that it deciphers to Transfer $90 to Carol (a 1-bit change with common encoding of text) or even Transfer $960 to John. All that's required is knowing the position, encoding, original and new value of what's changed, and that the new message is no longer than the original.
- If it's used public-key encryption, it's trivial to create from the public key a ciphertext that deciphers to anything an adversary wants.
Fortunately, cryptography also has solutions to that, with authentication (or about equivalently in a cryptographic context, integrity protection). The methods for that just are not named encryption. The proper names are
In symmetric cryptography, sender and receiver share a secret key (or passphrase) assumed not known to adversaries. Leaving aside confidentiality and encryption, for authentication using a MAC, a MAC is produced by the sender from message and key, and the MAC sent with the message (e.g. at end ). The receiver separates alleged message and alleged MAC, recomputes the MAC from alleged message and key, and tests if that's the alleged MAC. There's a match if there was no alteration, no match for most random alterations. It's practically impossible to make an alteration that's undetected without knowledge of (or derived from) the key.
In asymmetric cryptography also know as public key cryptography), the key becomes a public/private key pair. The private key is a secret known to the key pair's owner. The public key is assumed known to all (including the receiver). For authentication, a signature is produced by the sender from message and the sender's private key, and sent with the message. The receiver separates alleged message and alleged signature, feeds the sender's public key and alleged signature to a verification procedure, that outputs true if there was no alteration, or false for most random alterations. It's practically impossible to make an alteration that's undetected without knowledge of (or derived from) the private key.
Getting both confidentiality and authenticity
In symmetric cryptography, we can build authenticated encryption from normal encryption, and a MAC (e.g. over the result of the encryption). Increasingly, the two are integrated within the same primitive (e.g. AES-GCM).
In asymmetric cryptography, the sender encrypts with the receiver's public key, and signs with the sender's private key. The receiver checks the signature with the sender's public key, and deciphers with the receiver's private key.
