Encrypt and Data-Integrity: h=CRC-8(m) and c=Encrypt(k,m) then send (h,c) over a channel. Secure? [closed]

Question

m := plaintext message
c := Encrypt(k,m) (AES-128 in counter mode)
k := Key (16 Byte)
h1 := CRC-8/16/32(m)
h2 := CRC-8/16/32(c)

1. If i send (h1, c) over a channel, is this secure?

A CRC-8/16/32 is linear dependent, and we build it over the plaintext so I guess I can somehow get some informations about m or k only having c and h, right?

2. If I send (h2, c) over a channel, is this secure?

That can't be better, because if so its really easy man in the middle could simply create a valid (h2,c) pair, while if we send (h1,c) he need to know the plaintext to calculate a valid CRC?

Question

If there is a system, like the two mentioned above, how can a man-in-the-middle attack the system? Some examples and/or math is appreciated!

I know that you can't use a CRC for authentication in a real system, it is a theoretical question. There are people out there using CRC instead of real MAC. I just want to understand the risks of the (bad) CRC solution. (in detail with math)

Answer 1

Both of your schemes are flawed, and that is not because of CRC. If you replace the CRC with a cryptographic hash function, then your schemes are still insecure.

1. hash(m) + Encrypt(m, k)
   One is the purposes of encryption is to ensure confidentiality of the plaintext message. A message can only be revealed by cracking the 128-bit key. In contrast, the hash is independent of the key. If the number of possible plaintexts is limited, then an attacker can easily brute-force the plaintext.

   Since the hash function does not take the key as input, and AES is secure against known-plaintext attacks, there is no way to gain any information about the key from the hash.

2. hash(Encrypt(m, k)) + Encrypt(m, k) The hash function here does not guarantee the authenticity of the ciphertext, because anyone can calculate the hash. Unlike the previous scheme, this hash does not reduce the security of the encryption.

If your objective is authenticity, modify the second scheme by using HMAC instead of CRC. Or don't use a separate MAC and use AES in GCM mode instead of CTR.