Do symmetric cryptographic primitives provide both integrity and confidentiality?

Question

I understand that symmetric cryptographic algorithms provide confidentiality through the use of a key to encrypt plain text to cipher text but how can they provide for integrity as well?

Would it not be easy for an attacker to tamper with the bits in a message and give the receiver an incorrect (not necessarily coherent) message if they were able to intercept the encrypted cipher text? Especially considering that symmetric ciphers do not work well with authentication.

If this is indeed not the case and symmetric crypto can provide data integrity can you share with me examples of algorithms that implement this?

Answer 1

AES is an example of a symmetric algorithm. It maps a block of fixed size from one to another block of the same size, also using a fixed key size for both encryption and decryption. To support encryption (or decryption) of multiple blocks, a single operation of the block cipher is used in a mode.

Ciphers like AES in CBC mode indeed do not provide integrity, that is why they are typically used with another MAC construction to achieve integrity and authenticity (for example, HMAC-SHA256). This calculation can be done on either the plaintext (MAC-then-Encrypt/MAC-and-encrypt) or on the ciphertext (Encrypt-then-MAC). (For a comparison between these, see Should we MAC-then-encrypt or encrypt-then-MAC?)

Such an external construction is not required though with authenticated encryption, in which the cipher mode provides the integrity and authenticity properties. See AEAD: https://www.rfc-editor.org/rfc/rfc5116

AES in GCM mode calculates an authentication tag in addition to block encryption/decryption. This tag is appended to the ciphertext and allows for an integrity check which is also dependent on the key. If an attacker changes a single bit of the ciphertext or authentication tag, it can be detected.