# Ensuring integrity and confidentiality together with symmetric encryption

I've been required to answer a question:

As usually, we have Alice and Bob.

Suppose Alice wants to send a file F to Bob, ensuring integrity and confidentiality. They share a symmetryc key $$K_{ab}$$ and use AES. No hash algorithm is available.

Alice sends to Bob: $$Enc(K_{ab}, F)$$

In this simple scheme, are integrity and confidentiality guaranteed?

1. Confidentiality is guaranteed if we use CBC (cipher block chaining) for example. But this is obvious. If we use a symmetric encryption algorithm as AES we have to use CBC, CFB, OFB or whatever.. right? So this answer seems too simple.

2. I would say that a computer is not able to tell if the message has been tampered with. So i would use CBC along with a "weak" cryptographic checksum inside CBC. A longer non-cryptographic checksum is suspect and subtle attacks are known if CRC is short.

3. Use OCB (Offset Codebook Mode). This mode of operation get both encryption and integrity protection while making only a single cryptographic pass over the data.

Are these answers correct? Could you give some background why the are correct or not?

P.S.: I could get privacy of a message with CBC encryption and integrity with CBC residue as long as the two are computed with different keys, but this requires twice the cryptographic power of encryption alone.

• Note: OFB $\neq$ Offset Codebook Mode. OFB is output feedback mode and OCB is the short form of Offset Codebook Mode. – SEJPM Aug 24 '15 at 15:55
• Confidentiality of CBC is not automatically guaranteed. Often padding oracles apply, and those do break CBC confidentiality. – Maarten Bodewes Aug 25 '15 at 8:29
• But is there any particular problem with the given protocol? Is the answer related to any particular use of a mode of operation? – Loris Aug 26 '15 at 13:30
• Integrity is in no way guaranteed by your protocol, unless you are using an authenticated mode. In many non-authenticated modes, depending on the particular use-case, confidentiality might not even be guaranteed (e.g., CBC and padding oracles). So yes, there is a problem with the given protocol. – Stephen Touset Aug 27 '15 at 23:30