We are designing an encrypted file system. We plan to use the PCBC (Plaintext Cipher Block Chaining) encryption mode for encryption. This is because we desire the feature ("small changes in the ciphertext would propagate indefinitely when decrypting") in PCBC.
However, to our best knowledge, PCBC is not a good choice from security and privacy perspective. It is a non-standard mode. It suffers from the adjacent swap attack. It has been cryptanalysis for message integrity.
So, I want to ask questions:
Can PCBC provide confidentiality on message? I just find some materials for breaking the integrity of PCBC, and the book Applied Cryptography saying "Although no one has figured out how to exploit this weakness, Kerberos version 5 switched to CBC mode after the flaw was discovered." I am not aware of anything discussing the confidentiality provided by PCBC.
For integrity, we plan to append a message hash with the content of message for PCBC encryption, instead of using an identical block. But from a cryptanalysis paper which says "In fact, even if the final plaintext block is a CRC computed as a function of all the previous plaintext blocks, an attack along similar lines is still probably possible.", it seems it is insecure even using hash for integrity checking. So I want to ask whether it is secure if I apply this hash in the FIRST block, or if you can give any better suggestions for integrity checking.
We want, (a) the decryption succeeds only when both the entire ciphertext and key are used; (b) if the ciphertext is not integrated, even getting the key, any useful information about the message cannot be extracted. Besides PCBC, do you have any better suggestions on choosing a standard and secure mode to achieve our goal?