3
$\begingroup$

Would a scheme like the following work to allow authentication of a sender:

A nonce is appended to data, and the result is encrypted. The encrypted pack is sent to the other party. The sender then contacts the receiver through an authenticated channel (or one that is sufficiently good for the current purposes) and provides them with the nonce. When the receiver gets the encrypted file, they decrypt it. If the nonce matches the one given through the secondary channel, the encrypted pack is known to be from the sender.

Now, I realize no such scheme could provide non-repudiation, but the purpose in this case is simply to ensure that the encrypted pack has not been tampered with in transit. My presumption is that tampering with the encrypted pack without decrypting it has a high probability of creating gibberish, so the main threat of an MITM is the pack being removed and replaced with something else.

Does the approach above sound reasonable?

Improve this question
$\endgroup$
4
  • $\begingroup$ You appear to be trying to roll your own version of authenticated encryption. I recommend sticking with what already exists, and using an already-established approach like GCM, EAX, CCM, or (in the worst case) CTR with an HMAC of the encrypted data. $\endgroup$
    – Stephen Touset
    Commented Aug 9, 2013 at 1:39
  • $\begingroup$ @Stephen Touset I see no such efforts. All I see is that the asker wants to verify that the sender does indeed know the private key of the channel. I might be mistaken though. $\endgroup$
    – orlp
    Commented Aug 9, 2013 at 1:43
  • $\begingroup$ "...the purpose in this case is simply to ensure that the encrypted pack has not been tampered with in transit". Seems pretty clear to me. $\endgroup$
    – Stephen Touset
    Commented Aug 9, 2013 at 1:45
  • $\begingroup$ @StephenTouset Ah I missed that, in that case yes, use a standard mode for AE. $\endgroup$
    – orlp
    Commented Aug 9, 2013 at 1:47

1 Answer 1

Reset to default
2
$\begingroup$

No. Whether your presumption is true depends on the properties of the encryption scheme you are using. In a block cipher's CTR mode, or virtually any other stream cipher, an attacker can arbitrarily flip any bit so desired, and those bit flips only affect the bits in question. For block ciphers in CBC mode, a bit flip garbles the plaintext block in which the bit was flipped, but introduces another bit flip in the same position in the next plaintext block.

As you can see, errors do not necessarily propagate, unless the encryption scheme was designed for such, nor are they necessarily easy to catch. As such, I would recommend against the scheme you suggested.

Instead of generating a nonce, why not use that space to append a proper MAC, perhaps HMAC. Note that if you go with this approach, you should use a separate, independent key for the MAC.

Alternatively, use one of the authenticated block cipher modes. I'd recommend GCM, personally, but for more details, see Matthew Green's "How to choose an Authenticated Encryption mode". I recommend this approach, as it is quite difficult to mess up.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.