Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What can be considered as a downside of authenticating a ciphertext?

For example, can we say a drawback of authenticating a ciphertext is that we lose repudiation, for example, we can't prove to the person who performed encryption and then authentication, that he had encrypted some particular message M?

share|improve this question
With MACs you still have quite a bit of deniability. Especially if you leak the MAC secret after it was used, like OTR does. But since courts are often happy to accept plaintext logs, this might be rather academic. – CodesInChaos Apr 25 '13 at 13:09

Authentication is related to some notion of identity: a message (encrypted or not) is said to be authenticated if it can be guaranteed in some way that its originator is some specific entity. The definition of that entity, and the extent of the guarantee, depends on the context.

For instance, when two people (traditionally called Alice and Bob) share a common secret key K, they can encrypt data with K and also authenticate it relatively to K with a MAC: from the point of view of Bob, the MAC authenticates the message as originating from someone who knows K; from that, Bob infers that the message comes from Alice, because K is supposedly known only to Alice and Bob, and Bob remembers never having sent that specific message, so it must come from Alice.

However, third parties (Charlie), not knowing K, cannot verify the MAC, and thus cannot consider the message as authenticated. Even if Bob reveals K (e.g. Charlie is a Judge and Bob sues Alice with regards to the message contents which could be a contractual element), Bob cannot convince the Judge is really from Alice since Bob also knows K and could have produce the same message himself. In a nutshell, this is why banks are reluctant to authorize big stock exchange orders from customers through a Web-based interface: the bank can get some guarantee about the connected client's identity (that's authentication) but cannot turn that guarantee into a convincing proof for a third party.

In general, authentication is required whenever there is encryption. Encryption without authentication is robust only against passive-only attackers, who spy on the line but never modify any bit. This attack model turns out to be rarely realistic. Combining encryption and authentication properly is non-trivial. There are some encryption mode which do that.

The main drawback of authentication is that it tends to imply some slight overhead. If done properly, we are talking about a dozen extra bytes per message, and maybe a +20% CPU cost (which will not matter in most cases).

share|improve this answer
Hi, thanks. Let me be more precise what I meant. Imagine someone encrypts some value M and then signs it. Then at some later point in time one some other entity asks this person what did she encrypt? This person, may pretend that she encrypted M' by decrypting the cipher text with a "wrong" key, do you see what I mean? we lose repudiation in some sense. Whereas this would not be the case if the person signed the plain text. I think we may avoid this, if we ask the person to decrypt with the "right" key, isn't it? – user1999360 Apr 25 '13 at 19:55
Oh, you are talking about signatures, not authentication. Well, a signature may serve as proof (against the signer) only on what the input to the signature algorithm is. If the data is to be encrypted, you first sign it, then you encrypt the whole thing (data + signature in some format). Encryption is for confidentiality, but, by definition, when the signature is used (to resolve a dispute), the original message must be revealed. – Thomas Pornin Apr 25 '13 at 20:06
That's what I meant: but in my case imagine I need to first encrypt and then sign. Imagine I have message M, I encrypt it, e.g., C=Enc(k,M). Now I sign C. Now later someone comes and asks what I encrypted? I can say I encrypted M' (not equal to M) by decrypting C with a "wrong" key for example, isn't it? Do you see what I mean?. I don't want to sign the message first yet, as I am not planning to reveal the plain text message straight away, yet. – user1999360 Apr 25 '13 at 20:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.