1
$\begingroup$

I am new to ECC but I was wondering,

If there is a situation where instead of the ciphertext being falsified, the sent MAC was tampered. How does the receiver verify that the ciphertext is still correct? How can the receiver verify that only MAC is tampered with? How is it possible to know whether the sent MAC or Ciphertext is the one falsified?

If someone were to modify every MAC they can in a network, wouldn't that stop communication in that network? How could one verify that the MACs aren't tampered with?

$\endgroup$
1
  • 1
    $\begingroup$ Worse, you don't know if the derived symmetric MAC key is valid either as somebody could have messed with the included ephemeral public key used in ECDH/ECIES. $\endgroup$
    – Maarten Bodewes
    Aug 2 at 10:28

1 Answer 1

6
$\begingroup$

This actually apply to symmetric-key encryption in general, and isn't specific to ECC.

In short: if either ciphertext or MAC is modified, then the decryption fails as whole. There's no way to determine which of the 2 is tamperred if any of them is.

However, it's safe to assume that, any CCA-secure symmetric encryption guarantee the correctness of ciphertext with high confidence, if MAC is verified as correct. That's something to be sure.

Although, as mentioned in the comment, the origin of the ciphertext must remain questionable, since this is public-key encryption, it allows anyone, including adversaries, to send messages.

$\endgroup$
2
  • 2
    $\begingroup$ Don't be fooled that "correctness of ciphertext" does not imply authenticity of ciphertext: because that's public key encryption, anyone with the public key can encrypt any plaintext of their choice. The MAC (or CCA-security) is here to protect against attacks that alter genuine ciphertexts and attempt to gain knowledge about the corresponding plaintext from the reaction of the receiver, or attempt to get a partially altered plaintext to be accepted. $\endgroup$
    – fgrieu
    Aug 2 at 8:30
  • 1
    $\begingroup$ Added a comment below the question which might be integrated in the answer as well. $\endgroup$
    – Maarten Bodewes
    Aug 2 at 10:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.