enter image description here

This structure provides message authentication. My question is if someone finds the key he can simply change the message and compute new hash according new message and send it to the receiver. If so, how can hashing provide message authentication? This scheme totally depends on encryption algorithm than why do we add hash in this?

  • 2
    $\begingroup$ Obviously you need to assume that the key remains secret. In this case, the hash primarily adds integrity (error detection). It's the combined construction in which the cipher prevents somebody who lacks the key from manipulating the message that provides authentication. Also, note that schemes that use separate keys for encryption and authentication usually assumes they're derived from the same key material and is stored together, so their security model is usually near identical. $\endgroup$
    – Natanael
    Apr 14, 2019 at 19:18
  • 3
    $\begingroup$ No, hash then encrypt in general doesn't provide authentication -- even with the key secret, as intended. $\endgroup$ Apr 15, 2019 at 2:41
  • $\begingroup$ If the key remain secret than no one can alter the message than why would we take overhead of hash computation? @Natanael $\endgroup$ Apr 15, 2019 at 17:29
  • 1
    $\begingroup$ @UtsavPatel this is not universally true, see stream ciphers and CBC mode block cipher encryption. Some changes can be made even if you don't know the key or exact message. $\endgroup$
    – Natanael
    Apr 15, 2019 at 18:04

1 Answer 1


As indicated by Dave in the comments, hash-then-encrypt may not provide authentication, so the scheme in the picture you provided may not be secure at all.

Let's assume for this answer that the encryption scheme used is such that hash-then-encrypt is secure. It could for instance be mapped to AES-GCM which uses GHASH, or Poly1305 correctly paired with a block cipher.

The idea of authenticated encryption is not to provide security against leaking information about the key. If the key gets known to the adversary then all protection is lost.

Authenticated encryption provides message integrity - protection against changes of the ciphertext. These changes may be deliberate, i.e. changes of the ciphertext during transport by an adversary or non-intentional such as data loss by lower levels in the transmission.

If you don't provide message integrity then an adversary may change the ciphertext and thereby alter the decrypted plaintext message without this being detected. It could also trigger the availability of a plaintext oracle that may even compromise confidentiality of the message. Note that hash-then-encrypt may not provide protection against padding oracles if CBC mode encryption is used, as the padding is (commonly) removed before the hash is verified.

Besides that, it provides message authenticity: proof that the plaintext as encrypted by an entity holding the secret key. Nobody else would be able to encrypt a valid hash after all.

In short, the hash is there to protect the message, it doesn't protect the key.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.