0
$\begingroup$

I am working on this problem where the set up is like this:

There are three hosts: A, B and C. A wants to send a message to C which passes through B. At A the message is hashed, the hash is padded to the message and then the message + hash is encrypted and sent to B. B wants to check for message integrity for which it decrypts the message, extracts the hash and then verifies.

I have proposed an alternative. My point is that we should encrypt the message at A and then compute the hash of this encrypted message. Then we should send the encrypted message +hash. The advantage is that at B the message need not be decrypted. B can verify the hash on the encrypted message itself.

Is there some problem with my proposed strategy?

Improve this question
$\endgroup$
4
  • 2
    $\begingroup$ Possibly duplicate of Should we MAC-then-encrypt or encrypt-then-MAC? $\endgroup$
    – kelalaka
    Commented Oct 18, 2018 at 17:44
  • $\begingroup$ @kelalaka That question is about MAC. This one is about hash. I believe there is a difference between the two and the answers to that question do not clear my doubt. $\endgroup$
    – Kishan Kumar
    Commented Oct 18, 2018 at 18:37
  • $\begingroup$ @KishanKumar note that a hash over the ciphertext can be stripped away and recomputed for a changed ciphertext. Also note that an embedded hash also has security issues. The "ideal" solution would probably be to share a symmetric key between A and B and between A and C and MAC the ciphertext once for each of these keys. $\endgroup$
    – SEJPM
    Commented Oct 18, 2018 at 19:26
  • $\begingroup$ Hash-Then-Encrypt or Encrypt-the-Hash? $\endgroup$
    – kelalaka
    Commented Oct 18, 2018 at 21:26

1 Answer 1

Reset to default
4
$\begingroup$

Your scheme is of course insecure against any active attacks. B or another man-in-the-middle can just change the data and then calculate a new hash. This is why you need a MAC instead of a hash. And it depends on the method of encryption / hash if hash-then-encrypt is safe.

If anybody proposes such schemes you should try and use an authenticated cipher such as GCM. That will however still leave you vulnerable to protocol errors, so while you're at it: use TLS.

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ ... which would leave you vulnerable to implementation errors: hire an expert ;) $\endgroup$
    – Maarten Bodewes ♦
    Commented Oct 18, 2018 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.