2
$\begingroup$

Normally, it is necessary to use authenticated encryption if the message may be tampered with. Can the authentecation be omitted if the message has been otherwise authenticated?

$\endgroup$
  • $\begingroup$ Do you still want confidentiality? ​ ​ $\endgroup$ – user991 Feb 22 '16 at 9:11
  • $\begingroup$ @RickyDemer bad wording; edited $\endgroup$ – Demi Feb 22 '16 at 10:01
  • $\begingroup$ See my comment to Richie's answer. ​ ​ $\endgroup$ – user991 Feb 22 '16 at 10:41
2
$\begingroup$

Yes, message authentication can be omitted when using an appropriate digital signature on the ciphertext.

A digital signature hashes the message, then encrypts the hash with a nonce and asymmetric key, which makes the security similar to HMAC.

The reason authenticated encryption is preferred is that it is generally less computationally expensive than a digital signature, and easier to build a MAC construct that is side channel resistant.

$\endgroup$
  • 2
    $\begingroup$ Message "authentication can be omitted ... appropriate digital signature" on the ciphertext. ​ When it's on the plaintext, the result can be malleable for certain encryption schemes. ​ Also, digital signatures are not encryptions; see this question. ​ ​ ​ ​ $\endgroup$ – user991 Feb 22 '16 at 10:40
  • $\begingroup$ @RickyDemer In what way would they be malleable? $\endgroup$ – kasperd Feb 22 '16 at 11:27
  • $\begingroup$ @RickyDemer I made the assumption it was on ciphertext, as he was asking about authenticated encryption with authentication omitted, I will edit to make that crystal clear $\endgroup$ – Richie Frame Feb 22 '16 at 11:41
  • $\begingroup$ @kasperd : ​ ​ ​ For plaintext-ciphertext pairs ​ [p0,c0],[p1,c1],...,[pn,cn] , ​ the adversary can compose a ciphertext c such that which of p0,p1,...,pn,$\bot$ c decrypts to depends detectably on more of what the plaintexts were than just their lengths. ​ ​ ​ ​ ​ ​ ​ ​ $\endgroup$ – user991 Feb 22 '16 at 13:12
  • 1
    $\begingroup$ @kasperd : ​ ​ ​ No. ​ If there are IND-CPA encryption schemes, then there are are IND-CPA encryption schemes for which the E(S(m)||m) approach will be malleable, for the reason I described in my previous comment. ​ ​ ​ ​ ​ ​ ​ ​ $\endgroup$ – user991 Feb 22 '16 at 13:30
1
$\begingroup$

If you follow the advice to sign-then-encrypt rather than encrypt-then-sign, you should probably use authenticated encryption. Otherwise you are going to be decrypting unauthenticated ciphertext, which with certain ciphers can be dangerous.

For example, with CBC-mode encryption, decrypting unauthenticated ciphertext can allow a padding-oracle attack. If you have a stream cipher, or other malleable cipher, an attacker could be able to change it to some earlier (signed) message, which may violate protocol assumptions like that different nonces mean different messages.

If you are going to sign the ciphertext, then that will indeed take care of authentication as Richie Frame states.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.