4
$\begingroup$

I know that you can use for example CBC-MAC to verify data integrity and thus the password upon decryption.

But would there be security implications of just adding a constant string to the plaintext and if the first block is identical upon decryption we know the key was correct?

$\endgroup$
1
  • $\begingroup$ Is the constant string supposedly known to all users (i.e., it is not a secret value known only to the communicating parties)? If so a padding oracle attack might be possible. $\endgroup$
    – mikeazo
    Dec 1, 2012 at 0:31

1 Answer 1

4
$\begingroup$

It likely depends on the encryption algorithm you use, but the answer is likely NO, this method does not ensure the integrity of ciphertexts.

For example, suppose you're using CBC mode encryption. The value you get for the first plaintext block when decrypting depends only on the first ciphertext block and the IV. Hence, I could intercept a message and change the ciphertext in any way I wanted as long as I kept these two values the same. The resulting, tampered-with ciphertext would pass your proposed integrity check.

However, if you really are only trying to make sure the key is correct (so a user can be informed if they entered a password incorrectly, for example), rather than trying to provide a secure MAC, then this method should work. Just be aware that it's not secure in the MAC sense.

Your scheme will not adversely affect the privacy of the encryption algorithm, as long as the encryption algorithm is secure against chosen-plaintext attacks. All standard encryption algorithms, such as CBC, meet this requirement (as long as they're used with a secure blockcipher, such as AES).

In summary, your scheme (1) will not alert you if a third party tampers with a ciphertext (whereas CBC-MAC would); (2) will almost certainly succeed in letting users know if they're using the correct key; (3) will not compromise the security of the encryption algorithm.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.