RSA and encrypted authentication

Question

Symmetric algorithms such as AES provides modes such as GCM which can be used for authenticated encryption. Assuming that I'm using RSA instead of AES, does it still make sense to add authentication checks based on HMACs to encrypted data?

[EDIT] The usecase is that I'm to store data on a machine and wish to encrypt it. I can choose between RSA and AES, however, verifying its authenticity(whether or not its been tampered with/replaced etc) before or during decryption is important.

Answer 1

You do not normally encrypt data with RSA. What you do is that you encrypt a random key with RSA, and then you encrypt the data itself with a symmetric encryption algorithm (such as AES), using the random key. This is called hybrid encryption. The main reason why this is so is because RSA encryption is very limited in size: with a 1024-bit RSA key, you can encrypt at most 117 bytes, no more.

So, there is necessarily some symmetric encryption in the process (unless you are doing it wrong, or the data to encrypt is very short) and that part should include an integrity check, which is what GCM or EAX provides along with the encryption.

Anyway, regardless of the way you encrypt the data, you need an integrity check and RSA, by itself, will not provide it. Since assembling several cryptographic algorithms is a difficult task (it is easy to get it wrong), you really should rely on a library which does the work for you and has been reasonably verified to do things correctly (e.g. GnuPG).

Answer 2

I don't really know what's the problem ? If you want secrecy you use encryption if you want authenticity you use Digital Signatures, and in the same regard integrity. If you sign a Hash(RSA) either before or after encryption (AES). It depends on when you want to validate its integrity.

Answer 3

Just a suggestion:

You can first try to generate hash of the data using any well known Hash Algorithm (Ex: SHA-256) and then append the hash to the end of data and encrypt both the data and the hash with a symmetric algorithm (AES).

You need work out a way to keep track of where your data ends and where the hash begins (You can record the lengths at the beginning of the block)

When you retrieve the data, first decrypt it, then generate the hash of the data part again and verify it with the hash present before. This will help with both Integrity and Confidentiality. The approach is somewhat similar to the way TLS protects it's records.

Pls note that this doesn't provide authentication (It provides a way to check the authenticity of the data though) which I assume is not needed for you.

Hope this helps.

Answer 4

As you note, when referencing GCM there are a number of ways to do encryption plus authentication at the same time: Authenticated Encryption with Associated Data or Authenticated encryption. This should provide both at once and nicely sidesteps the issue of whether you should authenticate and then encrypt or encrypt and then authenticate.

For the benefit of people reading some of the other comments, the consensus, though is that if you must use one and then the other that encrpyt then authenticate is better from a cryptographic doom point of view.

If it's just for backup I don't see the use case for using public keys, it seems to make things more complicated, unless you have a turn-key solution.