I'm taking a course in information security and I have many unanswered questions!
I've learned that encryption doesn't guarantee authentication, which makes sense to me, but all the examples in the lecture and the ones I've found on Google seem very artificial or theoretic to me. For example one example was, that the attacker could modify some bits in the cipher text to increase or decrease the amount of money that need to be transfered. But how should anyone know the exact position of the bits representing this amount? Could anyone provide a more realistic example or explain why this is realistic?
A second question is about authentication with hash functions. For example when I download linux mint, I verify it with md5 (why do people still use md5, although it's considered completely broken?). So if anyone would make a MITM attack and forward a malicious distribution to me, I would notice it. But lets assume the adversary could find a collision in any of those secure hash functions. Then it doesn't help him, because he wants to modify the distribution in a special way, not just find another iso image that has the same hash value as the one provided, right?
I know there are already lots of questions regarding this topic, but I haven't found a link that satisfies me :-)