An example of an appropriate use case for AES-CBC encryption without authentication?

Question

I have been learning a lot by studying the questions and answers here on crypto.stackexchange.com and an grateful for this community.

Recently in this question AES in CBC Mode Is totally unsecure if no defense is provided for padding oracle attack, right? I learned that CBC is secure against chosen plaintext attacks even though it isn't secure (by itself) against chosen ciphertexts attacks or padding oracles attacks. That makes sense to me.

From what I have learned so far, I would think that there are no cases where using a CBC encryption mode would be wise unless it were paired with some kind of authentication algorithm like HMAC. But from the answers for the linked question above I get the impression that perhaps that's not true, and there are cases where such use might be reasonable.

What is a specific example of where using CBC mode encryption (ex. AES-CBC) without pairing it with validation would be an appropriate and reasonable choice?

Answer 1

Full disk encryption is only an example of encryption of data at rest. For that kind of usage CBC could suffice if only confidentiality is required. This is often the case if the user just wants to hide something, say an illegally downloaded movie. In that case you don't care if anybody can change the ciphertext, you just want to make sure that nobody finds out what is encrypted (possibly leaking the size of the file, which can be pretty unique for such large files, by the way).

The same goes for ransomware. If ransomware encrypts a file then the rightful owner can muck with the encrypted file as much as he wants; the data just gets further mangled. In this case I assume that there is no padding oracle attack, I suppose that the victim simply gets an application with the private key to decrypt files instead of the victim sending files over for decryption. That's one way to implement it anyway.