Normally, it is necessary to use authenticated encryption if the message may be tampered with. Can the authentecation be omitted if the message has been otherwise authenticated?
$\begingroup$
$\endgroup$
3
-
$\begingroup$ Do you still want confidentiality? $\endgroup$– user991Commented Feb 22, 2016 at 9:11
-
$\begingroup$ @RickyDemer bad wording; edited $\endgroup$– DemiCommented Feb 22, 2016 at 10:01
-
$\begingroup$ See my comment to Richie's answer. $\endgroup$– user991Commented Feb 22, 2016 at 10:41
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
6
Yes, message authentication can be omitted when using an appropriate digital signature on the ciphertext.
A digital signature hashes the message, then encrypts the hash with a nonce and asymmetric key, which makes the security similar to HMAC.
The reason authenticated encryption is preferred is that it is generally less computationally expensive than a digital signature, and easier to build a MAC construct that is side channel resistant.
answered Feb 22, 2016 at 8:21
-
2$\begingroup$ Message "authentication can be omitted ... appropriate digital signature" on the ciphertext. When it's on the plaintext, the result can be malleable for certain encryption schemes. Also, digital signatures are not encryptions; see this question. $\endgroup$– user991Commented Feb 22, 2016 at 10:40
-
$\begingroup$ @RickyDemer In what way would they be malleable? $\endgroup$– kasperdCommented Feb 22, 2016 at 11:27
-
$\begingroup$ @RickyDemer I made the assumption it was on ciphertext, as he was asking about authenticated encryption with authentication omitted, I will edit to make that crystal clear $\endgroup$ Commented Feb 22, 2016 at 11:41
-
$\begingroup$ @kasperd : For plaintext-ciphertext pairs [p0,c0],[p1,c1],...,[pn,cn] , the adversary can compose a ciphertext c such that which of p0,p1,...,pn,$\bot$ c decrypts to depends detectably on more of what the plaintexts were than just their lengths. $\endgroup$– user991Commented Feb 22, 2016 at 13:12
-
1$\begingroup$ @kasperd : No. If there are IND-CPA encryption schemes, then there are are IND-CPA encryption schemes for which the E(S(m)||m) approach will be malleable, for the reason I described in my previous comment. $\endgroup$– user991Commented Feb 22, 2016 at 13:30
$\begingroup$
$\endgroup$
If you follow the advice to sign-then-encrypt rather than encrypt-then-sign, you should probably use authenticated encryption. Otherwise you are going to be decrypting unauthenticated ciphertext, which with certain ciphers can be dangerous.
For example, with CBC-mode encryption, decrypting unauthenticated ciphertext can allow a padding-oracle attack. If you have a stream cipher, or other malleable cipher, an attacker could be able to change it to some earlier (signed) message, which may violate protocol assumptions like that different nonces mean different messages.
If you are going to sign the ciphertext, then that will indeed take care of authentication as Richie Frame states.
