1

How can I be certain the same key that was used for encryption? I have an encrypted payload. I use a key and the decryption algorithm to decipher it.

I understand data will be returned whether the key is correct (i.e. it was used for encryption) or not. Is this true of all or any algorithms?

At this point, how can the returned data be verified to be the original plaintext? The padding might already give some idea if present. I imagine some sort of hash (present in the encrypted payload) could also verify this. Are there standard or more creative methods to achieve this?

Improve this question

1 Answer 1

Reset to default
4

In practice all symmetric encryption algorithms are just algorithms that scramble data with a key, therefore you will always get some output data, even if you decrypt with the wrong key but will most likely just be random nonsense data.

The standard method is to hash the message with HMAC to get authentication. Most common is to do HMAC over the encrypted message, not the plaintext. Then upon reception you first verify the message and if that was ok, you decrypt it. Since people have done it wrong by mistake in the past, there are also "packeted" solutions that define how the symmetric cipher and the authentication tag should be created, like AES-CCM, AES-GCM and ChaCha20-Poly1305.

Improve this answer
2
  • Encrypt-then-MAC will catch modification of the ciphertext, either by attack or accident, but not using the wrong key to decrypt unless that key is the same as the MAC key or closely related which can be unsafe; AE safely uses one key for both and so can't fail that way. An alternative is to add enough redundancy -- either padding or explicit -- to the plaintext that wrong decryption has negligible chance of being accepted.
    – dave_thompson_085
    May 25, 2016 at 3:08
  • The "correct" way to deal with the fact that different keys should be used for encryption and authentication, is that those keys are derived from same master key, or that you simply have two keys. In ChaCha20-Poly1305 the authentication key is generated by first running the ChaCha20 algorithm once.
    – Emil
    May 25, 2016 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.