Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I'm developing a local file encryption/decryption software (AES-256 CBC), which I want to validate decryption was successful or not.
so I decided to add an additional MD5 hash of plain data to end of plain data and encrypt it together, and when decryption, calculate the MD5 hash of decryption data(except last additional MD5 hash) and compare it with last additional MD5 hash.
I want to know if this idea is safe to use.
Is it a bad idea?
What you are trying to do is called Authenticated Encryption, the combination of encryption and authentication in on scheme.
The simplest form of it is doing encryption and authentication seperately either by authenticating the plain text (Mac-Then-Encrypt or Mac-And-Encrypt) or doing it the other way round: Encrypting first and then calculating the checksum over the ciphertext. None of the three variants are inherently insecure, but the latter version is considered the most secure these days and it is also the easiest one to get right.
What has to be noted is, that you should not just calculate a hash as you suggested but a MAC instead (like HMAC-SHA256), which can not be forged by an adversary. A hash alone only protects the integrity of the message helping you against errors but not against attackers.
Apart from these, there are also encryption modes which combine the encryption and authentication in one operation. If you do not have a particular reason for sticking with AES-CBC, these modes would be preferred. The most popular of these modes would be AES-GCM, other options include AES-CCM, AES-OCB or ChaCha20-Poly1305..
