A question for an exam asks me to provide data integrity of a file F with AES and a shared secret key between Alice and Bob, if there is a way. The message is sent by Alice to Bob.

I thought of the following protocol:

  • Alice sends to Bob (Ek(F||k), F), where Ek means the encryption by AES with the secret k of the file F concatenated with the secret k.
  • Bob receives the message, takes F, concatenates k and computes AES. If equal, he accepts the message, if not he rejects it.

Could this approach work well? What could the attacker do?

  • 1
    data integrity != data security. Though encryption process protect the data, it doesn't mean the whole data is intact. You need a checksum.
    – mootmoot
    Jun 18, 2018 at 8:15
  • 1
    Data, if changed, when encrypted will have a different ciphertext. And Bob is able to understand this, if the file is changed by the attacker. Jun 18, 2018 at 8:33
  • 1
    @mootmoot: Ek(F||k) is a checksum. Albeit one which is larger than the original message
    – symcbean
    Jun 18, 2018 at 12:38
  • What block mode does Ek in your example use? It it’s chained you can use the last block only (which would basically be CBC-MAC). In that case you should start your plaintext with a length marker to make it resistent against variable length problems. If you are using ECB you have the problem that attackers an for example exchange blocks and the ciphertext can have the same permutations, so it is not secure. (You would need to start each block with a counter if you are not allowed to use another mode)
    – eckes
    Nov 16, 2018 at 3:15

1 Answer 1


provide data integrity of a file F with AES

One way to create a MAC from a block cipher is cipher block chaining message authentication code (CBC-MAC).

I thought at the following protocol

I would think there is some way that you learned during the course. Such questions generally don't intend for you to come up with your own scure crypto protocol.

Could this approach work well? How could the attacker do?

Basically you use the encryption of the file as the MAC. This is secure, but impractical. Your MAC would be about as big as your file, which doubles the size of every transfer.

  • Yes for the CBC, but I cannot use it. The file is supposed not to be great. I know it is impractical, but I was asked to give an hypothetical answer. Jun 18, 2018 at 7:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .