I have implemented a simple encryption/decryption program based on AES-256 in CBC mode1.
Actually, it is more precise to describe it as a compression+encryption / decryption+decompression program.
If one provides the wrong key to the decryption+decompression function, the decompression stage will explicitly fail, as expected, since the decrypted content (being based on the wrong key) will be just noise.
I would like modify the decryption phase of the scheme so that it detects on its own that the wrong key has been used, before it proceeds to the decompression phase. I am looking for a scheme to support this functionality that does not weaken the overall cryptographic strength of the framework.
A naive approach would be to generate the encrypted content as2
AES256_CBC(key, iv, SENTINEL_STRING + plaintext)
SENTINEL_STRING is a string that the decryption phase can know in advance. While I am being naive about it, I could make the
SENTINEL_STRING be equal to the key, for example.
I imagine there are pretty standard ways to solve this problem. In fact, for all I know, the design of AES-256-CBC already has built into it a way to check that decryption succeeded.
I hope someone can enlighten me on these matters.
Also, if this problem is common enough to have a generally accepted name (suitable as search engine fodder) please let me know.
1 For what it's worth, my current implementation of this uses Python's
pycrypto module, but an earlier implementation used Perl's
Crypto::CBC package. Both versions can reciprocally decrypt+decompress files compressed+encrypted by the other. I bother mentioning all this to stress the fact that this question is primarily about AES-256-CBC in general, and not about any specific implementation of it.
2 I hope my ad-hoc notation here is not too stupid. I mean it as a shorthand for "encrypt the string
SENTINEL_STRING + plaintext with AES-256 in CBC mode, using the key
key and initialization vector