I always see people warning not to use unauthenticated modes of operation like CBC for AES . Why is that so ? I mean if you use AES-CBC with a random IV you will most likely secure your data . So for what do you need MAC / authenticated modes like GCM for your files . If you cant assure that your data is tampered with on your own hard drive you are screwed anyway .


This question was about in place encryption . I understand the relevance of Authenticated stream ciphers like GCM in the context of sending data .

  • 6
    $\begingroup$ "If you cant assure that your data is tampered with on your own hard drive you are screwed anyway." Is data at rest protection the only thing you are interested in? What about saving encrypted files to the "cloud"? Or data in transit? $\endgroup$ – mikeazo Aug 3 '17 at 18:28
  • $\begingroup$ this Question was about in place encryption . sorry my fault for not explaining exactly $\endgroup$ – Richard R. Matthews Aug 3 '17 at 19:23
  • 2
    $\begingroup$ Thanks for the clarification. There are definitely threat scenarios where CBC mode (for example) still makes sense. My personal opinion is that most people, however, will do an awful job of assessing this, and so using an AE mode is the safest thing to do. $\endgroup$ – mikeazo Aug 3 '17 at 19:28
  • 1
    $\begingroup$ People store file based TrueCrypt containers in the cloud. Which is a bad idea, since they're unauthenticated. $\endgroup$ – CodesInChaos Aug 3 '17 at 19:30
  • 1
    $\begingroup$ @RichardR.Matthews Example: If an attacker can turn for example the valid SSH public keys into "rubbish" and somehow (else?) learn them, it's much easier to factor the modulus and get access. $\endgroup$ – SEJPM Aug 3 '17 at 20:05

For CBC mode, the issue boils down to the fact that you cannot detect if a man in the middle modified the message. The data is still confidential, the man in the middle cannot read it without the key, but they can modify it, and it still would be decrypted at the recipient.

Ideally you want to ensure data integrity. For CBC mode in particular, you can perform the CBC byte-flipping attack. Lets assume a message is encrypted, and you know a single block. You can convert that block into any block you desire, because of how CBC chaining works. The plaintext of the next block is xor'd with the ciphertext of the previous block. So by altering the previous blocks ciphertext, you change the block that the plaintext decrypts to. Thus in exchange for getting one block to decrypt to gibberish, an attacker can control what the next block decrypts to. This is undesirable. Hence Authenticated modes such as CCM and GCM are used.

An example use-case of GCM mode when sending data over the internet between a client and a server, such as in TLS. You don't want CBC byte flipping to be a possibility. You want to ensure that the data you decrypt is in fact what the person at the other end sent to you.

Also to your point about encrypted hard-drives, being able to have evidence of any data tampering is a desirable property. CBC byte flipping attacks would only be evidenced by file corruption when looked at through its respective program. Its possible that the tampered file could be rendered as valid.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.