How to check the integrity of a key received through mail using symmetric encryption?

Question

I would like to provide access to encrypted data through a cloud service provider, using a pay-as-you-go model. This means that we will sometimes need to revoke a user's access to the data. To restrict a revoked user's access, the CSP will re-encrypt the data and send the new key to valid users only through their mail.

Before using the new key they received by mail, however, the users will presumably need some way to verify its integrity and authenticity. If possible, I would like to implement this using only symmetric encryption (like AES) instead of asymmetric encryption like RSA. Is this possible, and if so, how?

Answer 1

Unfortunately, symmetric encryption do not provide integrity and digital signature functions. This is because symmetric encryption uses the same key for exncryption and decryption. This means that any who owns the decryption key can alter the data and no one will notice that the data is altered, because the same key was used for encryption.

This means that data integrity can be provided only by using asymmetric cryptography.

Answer 2

Well, yes, this is possible, but not without an initial setup phase. You can use an authentication key at the server. You then distribute each client a derived key using some kind of ID of the client. This key needs to be distributed in a secure fashion to the client (this is the setup phase).

When you change the data encryption keys you create an authentication tag / MAC (e.g. using HMAC) for the encryption key. You can even wrap the encryption key with the key used by the client so the client cannot use the key without also verifying it (e.g. by using GCM or SIV mode encryption). Well, technically they can simply ignore the verification, but that would take effort.

Note that symmetric schemes are substantially more brittle than ones based on asymmetric cryptography.