2

I've heard it stated that it is a common misconception that encryption provides data integrity.

A highly voted question on this topic - Does encryption guarantee integrity? - has some very insightful answers. For instance, the top voted answer states:

No. This is easy to see if you consider the one-time pad, a simple (theoretically) perfectly secure system. If you change any bit of the output, a bit of the clear text will change, and the recipient has no way to detect this.

That makes perfect sense, so I think it's clear that the answer to does encryption guarantee integrity is clearly no, but is it correct to state that encryption enables some other means of integrity verification, because an attacker may need to break confidentiality to determine what modification of a message can be applied and not be detected if a higher level integrity check on the data is applied?

For instance if a message already has some defined structure that a receiver is expecting(ie - only a subset of possible bit modifications would be valid), and the act of hiding the contents of that message makes it very difficult for an attacker to correctly select one of those possible modifications(or in fact if they have no information, the best they can do is randomly change bits), then in that case, encryption at least enables integrity, correct? Or viewed another way, because encryption could force an attacker to at best randomly change bits of the cipher text, then this could allow some pre-existing information to serve as some type of (perhaps not effective) integrity check? ie - changed bits could cause misspellings in a document, or could cause an encrypted code file to no longer correctly compile, despite a receiver somehow knowing the sender would not have misspelled those specific words, or would have sent compiling code.

Improve this question
1
  • no, you can use integrity mechanisms on non-encrypted content, a file download's MD5 for example
    – dandavis
    Commented Sep 6, 2017 at 3:55

1 Answer 1

Reset to default
2

Updated to make the explanation clear

Whether or not a given message follows a particular syntax is a very weak integrity check. It could also be a bug on the sender side which could result in messages not being of a particular format.

As mentioned in this answer, many common ciphers are trivially malleable. This means that it is possible to modify the encryption text to generate valid plaintexts. You are trying to go a step further by ensuring that the set of valid plaintexts is smaller. Sure, that makes the task a bit harder for the attacker but given enough time and datasets, the attacker may be able to pass your integrity check as well.

Consider the following scenario:
Alice is talking to Bob and Eve is listening to the conversation. They are using block cipher for confidentiality. After listening to the conversation for a while, Eve has enough ciphertexts to play with the block cipher that they are using. The next message that Alice sent is intercepted by Eve, merged with some other previous ciphertext and Bob is able to decrypt it and see that the format is correct. This message passes the integrity check even if it is a forgery.

Improve this answer
5
  • While I see what you are getting at, this does not really answer the question.
    – Tom K.
    Commented Sep 6, 2017 at 14:16
  • 1
    @Tom hopefully this helps
    – Limit
    Commented Sep 6, 2017 at 14:26
  • Thanks, and yes I completely agree that the cases I mentioned, such as a particular syntax check on the plaintext or some other means would be pretty weak. But what im really interested to know is that in the absolute sense, these things do in a way become a form of integrity check and that the specifics of just how weak they are is related to the conditions the attacker may be subject to, correct? For instance what if this data transit isnt over a traditional digital network, and the attacker has a single chance at modification, and no way to verify whether their attack worked?
    – krb686
    Commented Sep 6, 2017 at 18:37
  • In that case, the probability that their modification is detected becomes potentially much higher, right? I mean it can probably be calculated based on the scenario (for a code file, how many bytes and which of their modified values are valid, vs which arent or which cant be modified at all). I know this is extremely contrived and it isnt safe to assume realistically much of anything about the attacker's capabilities, so this thought may not be useful in the real world, but im curious in the theoretical sense here, so isnt the direct answer at least maybe
    – krb686
    Commented Sep 6, 2017 at 18:40
  • @krb686 Yes, "maybe" will work in the sense that there will be scenarios where decrypting the received text itself would tell us if the text has been modified. All I am saying is that this cannot be turned into a general statement about encryption enabling integrity.
    – Limit
    Commented Sep 6, 2017 at 18:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .