I understand that many schemes that provide data integrity involve a hash-then-encrypt approach. I was wondering if data integrity is achievable without confidentiality? Are there any mainstream protocols for this?

  • 6
    $\begingroup$ It's called a message authentication code and there a number of ways of building them. HMAC, CBC-MAC etc. These do not provide confidentiality. $\endgroup$ Dec 22, 2017 at 10:09
  • $\begingroup$ I guess it’s to late to edit; but what I was more interested in is if there are protocols that do not rely on some form of secrecy. As far as I understand, both keyed hash based protocols and the CBC-MAC involve some preagreed secrets. Are there any protocols that do not rely on any secrets? @YehudaLindell $\endgroup$
    – gen
    Dec 26, 2017 at 22:17
  • 1
    $\begingroup$ It is impossible to achieve integrity without some form of secrecy (or a pre-shared secret, or a signing key pair). $\endgroup$ Dec 27, 2017 at 19:45

2 Answers 2


Hash-then-encrypt is not a scheme that is used a lot. It may not be necessarily secure in all situations.

Instead message authentication codes (MAC) are used. These produce what is called an authentication tag (symbol: $t$); a fixed size, keyed hash over the processed data. Obviously, as a keyed hash it requires a key as input, preferably one specific for the MAC.

MAC can be split into hashes that are based on block ciphers or hashes. An example of a MAC is AES-CMAC; it is based on AES in CBC mode but it doesn't encrypt the plaintext (the intermediate ciphertext is not kept). It makes sense to use a block cipher based MAC if the block cipher - usually AES - can be used with hardware acceleration.

HMAC - which simply stands for Hash-based MAC - can be used with MD5, SHA-1 and SHA-2 as underlaying hash construct. As SHA-3 is already protected against length extension attacks it can be used with a more elegant approach called KMAC.

Nowadays authenticated ciphers such as AES-GMAC are becoming popular. Authenticated ciphers are usually AEAD ciphers: ciphers providing Authenticated Encryption with Associated Data. The associated data (AD) or additional authenticated data (AAD) within these schemes is also integrity protected and not encrypted.

This way you can decide yourself what data you want to keep confidential. If you want you can put everything in the AD, so you would not have any ciphertext, only plaintext and the authentication tag.

Usually you only need to provide a single key which can be used for both confidentiality and authenticity, simplifying key management somewhat.


  • You may require additional constructs such as a message counter or session keys for each sending entity to create a secure protocol; just having a MAC or authenticated cipher may not be enough.

  • Most cryptographers agree that encrypt-then-MAC is more secure than MAC-then-encrypt in most situations, so please keep that in mind if you do need to keep part of the data confidential.

  • When in doubt: use HMAC; it's the most common MAC, it has aged really well and provides lots of security. HMAC-SHA-256 - HMAC with SHA-256 as underlying hash algorithm (configuration parameter) is a good, secure, generally available algorithm. If you think a 32 byte tag is a bit too large you can just the 16 leftmost bytes instead.


Yes. Message integrity is a property of Authenticated Message that is not necessarily associated with encryption (confidentiality). Message integrity assurance is done by adding a MAC, Message Authentication Code, to the message. It can be added to an encrypted message, and in this cae the result is Authenticated Encryption, an it can also be used with non-encrypted message. This is independent cryptographic function.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.