2
$\begingroup$

I have an encryption scheme set up with a client and server that utilizes AES 256. What I am curious about is whether or not all information sent from the server to the client can be verified as legitimate using just a single digital signature (ECDSA, secp256k1 specifically) on the key that is sent to the client.

Given a key (k1, k2), and material (m1, m2), I have heard that the following behaviors of a block cipher are possible:

AES(K1,m1)=AES(K2,m1)

AES(K1,m1)=AES(K2,m2)

AES(K1,m1)=m1

(Source: https://crypto.stackexchange.com/a/60477)

Now I am curious, since I am positive that the key is verified as being legitimate, can I just use the client-sided decryption using AES256 with said key and not need any more digital signatures? Would it be possible say, for someone to get the client to decrypt two different messages using the same key in a malicious manner?

EDIT: Just intuitively, it would not seem to me that I would need a signature for every single message I want verified. I feel as though for some reason one single digital signature would be enough to verify legitimacy for all later messages.

$\endgroup$

1 Answer 1

1
$\begingroup$

can I just use the client-sided decryption using AES256 with said key and not need any more digital signatures?

Is the key private between the client and the server? If a third party also knows the key, he might be able to replace one of the legitimate ciphertexts with another one that decrypts to something else.

Are you using an authenticating modify of encryption of AES (for example, GCM)? Those have the property that no one who does not know the key can modify one of the ciphertexts with something else without being detected (that is, causing a decryption error on the client). Note that the client needs to protect against replay attacks - that is, the attacker replaces one of the ciphertexts with a previous ciphertext. Authenticating modes have tools to protect against that, however exactly how those tools are used depend on the protocol (and whether it needs to handle out-of-order messages or not).

If you make sure that the answers to the above two questions are "yes", then you're safe - if the client does not detect a decryption failure, then the plaintexts are exactly what the server sent. This is exactly what, for example, TLS depends on.

$\endgroup$
1
  • $\begingroup$ I am only using AES-CBC unfortunately. Looks like I have more work to do then. $\endgroup$ Commented Dec 24, 2022 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.