I am working on this problem where the set up is like this:

There are three hosts: A, B and C. A wants to send a message to C which passes through B. At A the message is hashed, the hash is padded to the message and then the message + hash is encrypted and sent to B. B wants to check for message integrity for which it decrypts the message, extracts the hash and then verifies.

I have proposed an alternative. My point is that we should encrypt the message at A and then compute the hash of this encrypted message. Then we should send the encrypted message +hash. The advantage is that at B the message need not be decrypted. B can verify the hash on the encrypted message itself.

Is there some problem with my proposed strategy?

up vote 4 down vote accepted

Your scheme is of course insecure against any active attacks. B or another man-in-the-middle can just change the data and then calculate a new hash. This is why you need a MAC instead of a hash. And it depends on the method of encryption / hash if hash-then-encrypt is safe.

If anybody proposes such schemes you should try and use an authenticated cipher such as GCM. That will however still leave you vulnerable to protocol errors, so while you're at it: use TLS.

  • 1
    ... which would leave you vulnerable to implementation errors: hire an expert ;) – Maarten Bodewes Oct 18 at 19:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.