I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below:

We show that generic compositions of confidentiality-secure encryption schemes with Manipulation Detection Code (MDC) functions for authenticated encryption are, in general, weaker than "encrypt-than-authenticate" compositions using strong Message Authentication Code [edit: (MAC)] schemes. Since the former compositions lead, in general, to authenticated encryption schemes that are faster, more power-efficient, and simpler implementations than the latter, we conclude that both types of composition are necessary in practice for different application environments.

Now despite this claim I cannot find any protocols that e.g. use the Infinite Garble Extension (IGE) or double IGE (biIGE) modes of encryption.

Furthermore I found the following rather alarming notes (that are more alarming since the aforementioned paper seems to be of a later date than the attack described in the last link):



So my two related questions are:

  1. Can there be any practical use of MDCs in general?
  2. Can there be any practical use of IGE or biIGE mode encryption?
  • 1
    $\begingroup$ This is because I came across a question on stackoverflow about IGE mode encryption. I'm planning on creating OpenSSL compatability classes in Bouncy Castle and I'm wondering if I should include this rather unknown block cipher mode of operation. $\endgroup$
    – Maarten Bodewes
    Commented Jul 23, 2013 at 19:50
  • $\begingroup$ Regarding your first question, cryptographic hash functions are (conjectured to be) MDCs, so they naturally have lots of practical uses... is this what you were intending? $\endgroup$
    – Reid
    Commented Jul 24, 2013 at 17:13
  • $\begingroup$ @Reid Yes, although I don't expect information on hash functions themselves. Only if they are used in combination with a symmetric cipher to provide authentication/integrity in addition to the confidentiality that the cipher should be providing. $\endgroup$
    – Maarten Bodewes
    Commented Jul 24, 2013 at 21:21

1 Answer 1


Don't believe every claim ever made in any paper ever written, particularly when the paper provides little or no justification for the claim; not everything you read reflects the cryptographic consensus. This is particularly true for a paper written in 2002, which is a time our understanding of authenticated encryption and security engineering was still in flux.

Today, the conventional wisdom is: just use authenticated encryption, such as GCM, EAX, etc. For most purposes, there's really no compelling reason to ever use a special MDC-based scheme.

Can there ever be any practical use to MDCs? I don't know; that's too broad a question to answer. I don't know if anyone can ever convincingly tell you "no, they will never ever be useful, I absolutely guarantee it". But in general, I don't see much use to MDC-based schemes. I find it hard to imagine practical situations where I'd want to use a special MDC-based scheme. Standard authenticated encryption schemes are good enough.

I don't recommend use of IGE nor biIGE modes: if you have to ask, you shouldn't be using them. (There may be some very special situations where one might use them -- see, e.g., this use of biIGE in Minx, a system for anonymous communication -- but those are the exception instead of the norm.) For almost all ordinary real-world situations that you're likely to encounter, an authenticated encryption scheme is going to be adequate. Researchers have invented tons of clever ideas ever invented, but that doesn't mean they're all useful; in practice, a handful of standard primitives will cover you for 99% of real-world situations.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.