1
$\begingroup$

I want to be able to verify the integrity of a ciphertext by providing the cleartext hash, for this to work it would need to:

$$hash(crypt(cleartext)) = f(hash(cleartext))$$

Where $f$ is an arbitrary function mapping the cleartext hash to the ciphertext hash.

Is there such a pair?

Update: I'm trying to prove the integrity to the receiver while delaying the key exchange until I'm ready to commit (send him the decryption details). The hash that proves the integrity comes from another source entirely.

|improve this question
$\endgroup$
  • 1
    $\begingroup$ What do you mean by "integrity of the ciphertext"? (I notice you say "integrity" instead of "authenticity".) Why can't you just provide the hash of the ciphertext? $\endgroup$ – user991 Dec 20 '11 at 19:49
  • $\begingroup$ Because I (A) want to be able to send the encrypted payload to the B, previously received from a C. B receives an integrity hash from C, and B needs to be sure that the cleartext he will get from decrypting the ciphertext A provided him with is indeed what he needs. If C were able to provide the ciphertext hash that means that C could also provide B with the key, which is not my goal. $\endgroup$ – cdecker Dec 20 '11 at 21:15
4
$\begingroup$

There really isn't such a function $f$; encryption algorithms attempt to generate what looks like random bitstrings (at least, it looks that way to anyone who doesn't know the key), and because the plaintexts and the ciphertexts look unrelated, their hashes are also going to look unrelated.

On the other hand, what is the problem you're trying to solve? When you say 'verify the integrity of a ciphertext', who is doing the verification?

  • Are you trying to allow the decryptor to verify that the message he got was the message that the encryptor sent without someone modifying it in the middle? If that's the case, the standard way of addressing it is with a Message Authentication Code

  • Are you attempting to allow the encryptor to verify that the encryption process proceeded properly? About the only ways to do that are to either run the encryption process again (with the same IV) and compare, or attempt to decrypt the ciphertext and compare.

  • Are you trying to allow someone in the middle (without the keys) to verify that a specific ciphertext happens to be a specific plaintext? Well, that would be an unusual requirement; I don't have any bright ideas on that one.

|improve this answer
$\endgroup$
  • $\begingroup$ You're right I forgot to explain the scenario. See the update. $\endgroup$ – cdecker Dec 20 '11 at 14:51
  • $\begingroup$ I added the function to map the output to the one I'm looking for, but I haven't thought about the pseudo-randomness, so yes there's no point in it. $\endgroup$ – cdecker Dec 21 '11 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.