17 votes
Accepted

Does the order of validations and MAC with clear text matter?

I'd always first verify the MAC. It makes more sense protocol-wise, as you are just left with the plaintext values after performing the cryptographic operations. Maybe you want to use a container ...
Maarten Bodewes's user avatar
  • 92.6k
12 votes
Accepted

Should the identity of a sender be verified using additional means, or does a MAC suffice?

It is a recurring topic: what exactly is identity and how to prove it ? But related to your question: a MAC (correctly implemented) proves that the author of the message was in possession of the ...
entrop-x's user avatar
  • 372
12 votes

How can you prove that a certain file was downloaded from a certain website?

This is possible, but only with the co-operation of the website. Whatever the downloaded file is, along with the associate metadata such as time and server identity, can be cryptographically hashed to ...
Daniel S's user avatar
  • 23.9k
12 votes

How can you prove that a certain file was downloaded from a certain website?

Daniel S explains what is needed to provide repudiation for file downloads, so I'll explain why you cannot prove a file was downloaded in the typical situation when using regular TLS. When a server ...
forest's user avatar
  • 15.3k
11 votes
Accepted

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

Actually section 6.2.3.3 of RFC 5246 talks about the associated data: The additional authenticated data, which we denote as additional_data, is defined as follows: ...
SEJPM's user avatar
  • 46k
10 votes

HMAC with public-private key

Consider the following system involving a message authentication code like HMAC-SHA256: Alice generates a key and shares it with Bob, and Bob alone. Alice authenticates a message with the key. Bob ...
Squeamish Ossifrage's user avatar
7 votes
Accepted

How to provide integrity even though using Authenticated Encryption?

There are several concepts of integrity. Authenticity can be thought of as integrity of the association between data and its creator/modifier/sender. There is also integrity of the internal structure ...
Mikko_K_123's user avatar
7 votes

Integrity with anti-confidentiality

Sending information covertly when using legitimate systems is a well-studied field. As another question mentions, key words are covert channel and subliminal channel. Designing systems with no covert ...
K.G.'s user avatar
  • 4,677
7 votes

How to use cryptography to assure data integrity?

If I want to ask a potentially compromised server to remember a file that I don't have room to store myself, I can pick and remember a 256-bit secret uniformly at random, and compute a short—say, 128-...
Squeamish Ossifrage's user avatar
7 votes
Accepted

How are AEAD, GCM, CBC, Poly1305, EtM, MtE and E&M related?

I do not know how they are related to each other. EtM, MtE and E&M are generic constructions that take pairs of schemes that satisfy weaker security notions (chosen-plaintext security and ...
SEJPM's user avatar
  • 46k
7 votes
Accepted

How do AES and DES ensure data integrity?

Answer to your question title: they don't. Answer to your inline question: yes (or something similar to it). Longer answer: Both DES and AES are examples of block ciphers, and block ciphers do not ...
hakoja's user avatar
  • 2,725
7 votes
Accepted

Can ChaCha20 provide integrity?

ChaCha20 has Ind-CPA security and beyond this ( Ind-CCAx.. [1]), you need integrity and authentication. And note that Authenticated Encryption > Ind-CCA. ChaCha20 is already teamed with Poly1305 ...
kelalaka's user avatar
  • 48.5k
6 votes

Integrity with anti-confidentiality

RSA with PKCS#1 v1.5 padding for signature genernation would work, as the algorithm is fully deterministic. The random padding is only used for RSA with PKCS#1 v1.5 padding for encryption which is ...
Maarten Bodewes's user avatar
  • 92.6k
6 votes
Accepted

What is the practical use of MDC

The goal of a MDC is to provide integrity guarantees. That is, given the value $h(x)$, it should be possible to check whether $x$ has been tampered with. The attack scenario you are describing ...
dade's user avatar
  • 1,323
6 votes
Accepted

Does it matter if I publish only publish good or bad MD5 hashes after recovering from a hack?

Does it matter? Yes: there's a qualitative difference in the types of attacks that would break your system. The elephant in the room, of course, is MD5, but let's examine the qualitative difference ...
Squeamish Ossifrage's user avatar
6 votes
Accepted

How reassuring is CRC-then-XTS as authenticated encryption?

No, this does not make a deterministic authenticated cipher, unless you're using a secret CRC as a MAC. How do you break it? First, find a pair of messages $m = m_1 \mathbin\| m_2$ and $m' = m'_1 \...
Squeamish Ossifrage's user avatar
6 votes

Why does symmetric encryption not provide authentication and integrity? Is it only this type of encryption or cryptology in general have this issue?

Confidentiality vs authenticity Encryption aims at transmitting a secret message, maintaining it's confidentiality. It does not necessarily provide integrity or authenticity. That it to say, even with ...
fgrieu's user avatar
  • 141k
5 votes

We can obtain "absolutely perfect CONFIDENTIALITY" using the one-time pad. Is there such a thing as "absolutely perfect INTEGRITY"?

Yes, there is the one-time MAC. This is a scheme which ensures that an adversary (even one with infinite computational resources) has a negligible chance of altering the message or forging a fake ...
J.D.'s user avatar
  • 4,445
5 votes
Accepted

Difference between INT-CTXT and INT-PTXT

My answer is taken from the following paper http://cseweb.ucsd.edu/~mihir/papers/oem.pdf (it is a well-written paper, so if you are interested in this topic I highly recommend you to read it). ...
hakoja's user avatar
  • 2,725
5 votes

Should the identity of a sender be verified using additional means, or does a MAC suffice?

Like entrop-x says, a valid MAC proves that the sender (or, more specifically, whoever computed the MAC) knows the secret MAC key. That can be sufficient to prove the sender's identity, e.g. if the ...
Ilmari Karonen's user avatar
5 votes
Accepted

Is message integrity possible without confidentiality? Are there any mainstream protocols?

Hash-then-encrypt is not a scheme that is used a lot. It may not be necessarily secure in all situations. Instead message authentication codes (MAC) are used. These produce what is called an ...
Maarten Bodewes's user avatar
  • 92.6k
5 votes

Stream cipher with an additional integrity stream?

Break your stream into chunks. Use an AEAD for each chunk using the chunk sequence number as a nonce. Anything else is going to have at best the same effect, but will be convoluted, full of holes ...
Squeamish Ossifrage's user avatar
5 votes
Accepted

Which algorithm has better performance (HMAC, UMAC, and Poly1305)?

First of all, HMAC—with any particular hash function, say HMAC-SHA256—is a different type of thing from UMAC and Poly1305. So it would be misleading to compare them directly. HMAC-SHA256 is a ...
Squeamish Ossifrage's user avatar
5 votes
Accepted

Can homomorphic encryption offer program integrity and program obfuscation?

If the homomorphic evaluation procedure is deterministic, as is usually the case, the program integrity requirement is trivially fulfilled: given a function $f$, the input ciphertext $C$ and the ...
Geoffroy Couteau's user avatar
5 votes

Can a MAC be used as a HMAC?

HMAC is a type of MAC. The output of a MAC is called a "tag". Not all MAC (algorithms) are HMAC. MACs are not required to be one-way or collision resistant for someone who knows the key. HMAC, ...
Future Security's user avatar
4 votes
Accepted

Properties provided by GCM

Authenticity of the data assures that the data in question was created or modified by an authorized party (a key holder). Without authenticity, anyone could present an arbitrary block of data as a ...
Ella Rose's user avatar
  • 19.6k
4 votes

Blockchain use in record management

The purpose of the bitcoin block chain is to provide an imitable public ledger. If you read the original bitcoin paper you will see that the block chain is but one component of a larger whole that ...
dave.zap's user avatar
  • 493
4 votes
Accepted

Does Salsa20 protect integrity?

Salsa20 alone does not protect integrity. Poly1305 protects integrity, as it is a Message Authentication Code (MAC). A MAC takes a secret key and a message, and outputs an authentication tag. Any ...
SAI Peregrinus's user avatar
4 votes
Accepted

What does encryption with RSA public key provide?

Properly done encryption with the RSA public key of the server provides confidentiality of the request, but not integrity or proof of origin (anyone can forge a request with any desired content). ...
fgrieu's user avatar
  • 141k
4 votes
Accepted

Are there better alternatives to CRC32 for distributed download components hash calculation?

I'll assume we want a cryptographic hash giving security in the Random Oracle Model; collision-resistance and preimage-resistance follows. Collision-resistance alone rules out CRC, regardless of size. ...
fgrieu's user avatar
  • 141k

Only top scored, non community-wiki answers of a minimum length are eligible