I am an application developer, implementing client-side crypto to protect data that is then transmitted to be stored on a server. The application uses AES with CBC mode with a resulting encrypt-then-mac HMAC to authenticate.
The process looks something like this:
key_material = kdf(password, salt) mac_key = first_half(key_material) enc_key = second_half(key_material) iv = random_bits() ct = aes_cbc(plaintext, iv, enc_key) mac = hmac_sha256(ct, iv, mac_key)
This results in a
mac that are then transmitted to the server. The server then delivers that information back to the client each time the application starts (and user enters their
password) in which the whole process is then reversed for decryption.
mac. If validation fails, abort with error.
- Decrypt to
I understand the need for the
mac in order to validate the authenticity of the message before the application proceeds to decrypt the
plaintext to display to the user.
However, I am having trouble understanding how authentication protects against anything else. I have read that authentication will protect against things like Chosen Ciphertext Attacks (CCA). My understanding of a CCA attack is:
A class of attacks in which the attacker modifies encrypted traffic in specific ways and may learn plaintext by observing how the decryption fails.
If an attacker obtains access to the stored
mac don't they have everything that they need to "observe how the decryption fails"?
From my understanding,
mac validation is an application implementation. The attacker doesn't necessarily have to use my application to observe how the decryption fails. They could just write their own application that doesn't do the
mac check (or just modify my open source application and remove the
Am I missing something here? How does authentication (more specifically encrypt-then-mac) protect against attacks like CCA?