I'm building an application for securely backing up cryptocurrency private keys or 12-word backup phrases that crypto wallets use as a seed to generate private keys. For the purpose of this question, if you're unfamiliar with cryptocurrency, you just need to know that whoever knows your private key can spend your money.
This is the backup process:
- The user encrypts his plaintext with a password (I'm using scrypt and AES256)
- The ciphertext is base64-encoded, and both the ciphertext and some header data are encoded as a single QR code -- this is the user's backup
- The user prints several copies of the QR for storage
- If the user's computer crashes and he needs to restore his backup, he can scan the QR code and provide the password to decrypt the message and retrieve his private key(s)
The QR code contains the scrypt parameters, salt, initialization vector, and the ciphertext.
My question is: Do I need to add an HMAC signature to the contents of the backup? If possible, I'd like to leave it out, since it significantly increases the complexity of the resulting QR code, and complex/large QR codes are more difficult for devices to scan.
I'm thinking I don't need an HMAC signature because, if the ciphertext is altered in any way by a malicious party, the resulting altered plaintext will be useless to the user - he won't be able to recover his cryptocurrency. Altering the ciphertext would produce the same results as simply destroying the user's backups (a signature can't protect against that). A length extension attack would also be pointless in this context.
The fact that an altered backup is useless seems like a built-in integrity check, making a signature redundant. Is this conclusion correct, or do I need to add a signature?