Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Symmetric algorithms such as AES provides modes such as GCM which can be used for authenticated encryption. Assuming that I'm using RSA instead of AES, does it still make sense to add authentication checks based on HMACs to encrypted data?

[EDIT] The usecase is that I'm to store data on a machine and wish to encrypt it. I can choose between RSA and AES, however, verifying its authenticity(whether or not its been tampered with/replaced etc) before or during decryption is important.

share|improve this question
Would you like to be more specific about what exactly you are authenticating? Im slightly confused as to which technology to answer your question with – Rell3oT Dec 6 '12 at 6:02
Authentication to make sure that the data is not tampered with at rest. – bling Dec 6 '12 at 6:38
You normally don't use RSA instead of AES, you use it in addition to AES. If you don't describe what you're doing and even more importantly what the security goals are, we can't really help you. – CodesInChaos Dec 6 '12 at 7:18
Having the choice between AES and RSA is weird. In the places where RSA is a good choice, AES doesn't work because it's symmetric. My suggestion is to either use RSA-Enc + AES + MAC or RSA-Enc + AES + RSA-Sig. But your description is still extremely vague. How large is the data? Why do you need asymmetric encryption? Should a third party be able to verify the integrity but not be able to decrypt?... – CodesInChaos Dec 6 '12 at 10:08
up vote 2 down vote accepted

You do not normally encrypt data with RSA. What you do is that you encrypt a random key with RSA, and then you encrypt the data itself with a symmetric encryption algorithm (such as AES), using the random key. This is called hybrid encryption. The main reason why this is so is because RSA encryption is very limited in size: with a 1024-bit RSA key, you can encrypt at most 117 bytes, no more.

So, there is necessarily some symmetric encryption in the process (unless you are doing it wrong, or the data to encrypt is very short) and that part should include an integrity check, which is what GCM or EAX provides along with the encryption.

Anyway, regardless of the way you encrypt the data, you need an integrity check and RSA, by itself, will not provide it. Since assembling several cryptographic algorithms is a difficult task (it is easy to get it wrong), you really should rely on a library which does the work for you and has been reasonably verified to do things correctly (e.g. GnuPG).

share|improve this answer

I don't really know what's the problem ? If you want secrecy you use encryption if you want authenticity you use Digital Signatures, and in the same regard integrity. If you sign a Hash(RSA) either before or after encryption (AES). It depends on when you want to validate its integrity.

share|improve this answer

Just a suggestion:

You can first try to generate hash of the data using any well known Hash Algorithm (Ex: SHA-256) and then append the hash to the end of data and encrypt both the data and the hash with a symmetric algorithm (AES).

You need work out a way to keep track of where your data ends and where the hash begins (You can record the lengths at the beginning of the block)

When you retrieve the data, first decrypt it, then generate the hash of the data part again and verify it with the hash present before. This will help with both Integrity and Confidentiality. The approach is somewhat similar to the way TLS protects it's records.

Pls note that this doesn't provide authentication (It provides a way to check the authenticity of the data though) which I assume is not needed for you.

Hope this helps.

share|improve this answer
That approach is generally discouraged. Generally authenticated modes (AES-GCM, etc.) or Encrypt-Then-MAC are preferred. – CodesInChaos Dec 6 '12 at 10:05
@CodesInChaos, Why is Encrypt-Then-MAC preferred then MAC-Then-Encrypt? I am not clear on this. – Jay Dec 6 '12 at 10:20
You can use Encrypt-Then-MAC, but you have to be more careful designing the scheme. There are combinations, such as MAC then encrypt with AES-CBC that have weaknesses. See Should we MAC-then-encrypt or encrypt-then-MAC? on crypto.SE for details. – CodesInChaos Dec 6 '12 at 10:27

As you note, when referencing GCM there are a number of ways to do encryption plus authentication at the same time: Authenticated Encryption with Associated Data or Authenticated encryption. This should provide both at once and nicely sidesteps the issue of whether you should authenticate and then encrypt or encrypt and then authenticate.

For the benefit of people reading some of the other comments, the consensus, though is that if you must use one and then the other that encrpyt then authenticate is better from a cryptographic doom point of view.

If it's just for backup I don't see the use case for using public keys, it seems to make things more complicated, unless you have a turn-key solution.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.