I have implemented a simple encryption/decryption program based on AES-256 in CBC mode1.
Actually, it is more precise to describe it as a compression+encryption / decryption+decompression program.
If one provides the wrong key to the decryption+decompression function, the decompression stage will explicitly fail, as expected, since the decrypted content (being based on the wrong key) will be just noise.
I would like to modify the decryption phase of the scheme so that it detects on its own that the wrong key has been used, before it proceeds to the decompression phase. I am looking for a scheme to support this functionality that does not weaken the overall cryptographic strength of the framework.
A naive approach would be to generate the encrypted content as2
AES256_CBC(key, iv, SENTINEL_STRING + plaintext)
SENTINEL_STRING is a string that the decryption phase can know in advance. While I am being naive about it, I could make the
SENTINEL_STRING be equal to the key, for example.
I imagine there are pretty standard ways to solve this problem. In fact, for all I know, the design of AES-256-CBC already has built into it a way to check that decryption succeeded.
I hope someone can enlighten me on these matters.
Also, if this problem is common enough to have a generally accepted name (suitable as search engine fodder) please let me know.
1 For what it's worth, my current implementation of this uses Python's
pycrypto module, but an earlier implementation used Perl's
Crypto::CBC package. Both versions can reciprocally decrypt+decompress files compressed+encrypted by the other. I bother mentioning all this to stress the fact that this question is primarily about AES-256-CBC in general, and not about any specific implementation of it.
2 I hope my ad-hoc notation here is not too stupid. I mean it as a shorthand for "encrypt the string
SENTINEL_STRING + plaintext with AES-256 in CBC mode, using the key
key and initialization vector