0
$\begingroup$

I am working on this problem where the set up is like this:

There are three hosts: A, B and C. A wants to send a message to C which passes through B. At A the message is hashed, the hash is padded to the message and then the message + hash is encrypted and sent to B. B wants to check for message integrity for which it decrypts the message, extracts the hash and then verifies.

I have proposed an alternative. My point is that we should encrypt the message at A and then compute the hash of this encrypted message. Then we should send the encrypted message +hash. The advantage is that at B the message need not be decrypted. B can verify the hash on the encrypted message itself.

Is there some problem with my proposed strategy?

$\endgroup$
  • 2
    $\begingroup$ Possibly duplicate of Should we MAC-then-encrypt or encrypt-then-MAC? $\endgroup$ – kelalaka Oct 18 '18 at 17:44
  • $\begingroup$ @kelalaka That question is about MAC. This one is about hash. I believe there is a difference between the two and the answers to that question do not clear my doubt. $\endgroup$ – Kishan Kumar Oct 18 '18 at 18:37
  • $\begingroup$ @KishanKumar note that a hash over the ciphertext can be stripped away and recomputed for a changed ciphertext. Also note that an embedded hash also has security issues. The "ideal" solution would probably be to share a symmetric key between A and B and between A and C and MAC the ciphertext once for each of these keys. $\endgroup$ – SEJPM Oct 18 '18 at 19:26
  • $\begingroup$ Hash-Then-Encrypt or Encrypt-the-Hash? $\endgroup$ – kelalaka Oct 18 '18 at 21:26
4
$\begingroup$

Your scheme is of course insecure against any active attacks. B or another man-in-the-middle can just change the data and then calculate a new hash. This is why you need a MAC instead of a hash. And it depends on the method of encryption / hash if hash-then-encrypt is safe.

If anybody proposes such schemes you should try and use an authenticated cipher such as GCM. That will however still leave you vulnerable to protocol errors, so while you're at it: use TLS.

$\endgroup$
  • 1
    $\begingroup$ ... which would leave you vulnerable to implementation errors: hire an expert ;) $\endgroup$ – Maarten Bodewes Oct 18 '18 at 19:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.