I've got a task to provide the integrity and an authenticated encryption for files in our application. I need an assurance if my way of thinking is correct.
I can't use AES GCM, I have to stay with CBC mode.
File is logicly divided in 5MiB chunks that are going to be encrypted using same key. IV of first block is randomly generated and the IVs of next blocks are going to be extracted from previous block ciphertext.
Here, below I choosed two possible scenarios how to provide an authenticated encryption and data integrity for file:
At first I encrypt first chunk of file with
key and recive
Next I calculate
hmac(key, ciphertext) and store it to verify during decryption. For each next encrypted chunk of file I create mac with below formula:
hmac(key, previous_hmac || ciphertext)
And store it to verify during decryption.
Is it proper to do it this way? Is it appropriate to store only last computed hmac in this chained hmac version alongside encrypted file, if it's not important which block was violated, for veryfication purposes?
The second solution I consider, is to calculate:
hmac(key, block_number || ciphertext)
for each chunk of file and store computed MAC alongside each ciphertext for veryfication during decryption attempt.
ciphertext is encrypted file fragment and
block_number is constant bit width integer, which value is fragment offset in file.
Is this an acceptable solution? I know it allows to find violated block among unimpaired ones.
I'm not quite sure, which one of given above solutions is better. I would be thankful if someone could give me an advice which one should I chose or propose a better solution. Any links to lectures also would be appreciated. Thanks.