Gilles made the following comment here:
using authenticated encryption does not guarantee integrity, only authenticity. You can't detect a rollback.
From what I gathered:
Authenticated Encryption provides authenticity of the data see here.
Authenticated Encryption is basically computing a MAC at the same time as you encrypt see here.
We have the usual 3 properties as follow:
confidentiality: only the authorized users can read the data (and understand it).
integrity: the users have the guarantee that the data have not been modified, or in other words only the authorized users can modify the data.
authenticity: the users have the guarantee that the data/entities are who they are (this is different from identification).
Gilles' scenario is the following:
- Our beloved Alice store some data on a server, using Authenticated Encryption.
- At some point Eve hacks into her server and take a copy of the encrypted data.
- Alice store some data again on the server, still using her secure Authenticated Encryption.
- Eve replace the data by the ones she took earlier (thus the tag is still valid).
Therefore we have a rollback. Bob accessing the data can see that they are authentic, i.e. they do come from Alice.
Can we consider that the integrity of the data is preserved or not ? At the same time they have been modified (the replacement) but the previous data have not been modified (in order to keep the Authentication Tag valid). Should the property of integrity not being preserved in this case?
Is there any scheme at all that provide such property or is it something that should be provided using another way (e.g. a version system that is not kept at the same place as the data) ? In other words, is there any Encryption scheme that allows to detect roll backs (as far as I know, there isn't) ?
I do see that if the data have been modified then the Authentication is not provided anymore as the tag won't match. Or from a logical point of view:
$$\neg Integrity \implies \neg Authenticity$$
thus using the logical contraposition we get:
$$Authenticity \implies Integrity$$
Which seems to contradict Gilles' comment.