1

I stumbled upon Microsoft Office's feature of file encryption. For storing sensitive data in the cloud, e.g. DropBox, this sounds like a nice feature. Reading that the encryption is AES-128 in CBC mode by default, it seems to provide a decent level of confidentiality, even though are still some open details.

Of course usual symmetric encryption does not provide integrity, but as I know Microsoft I wouldn't be too surprised to learn that they actually also meant some kind of integrity protection by naming it encryption. However, this lead me to the following question I wasn't able to find an answer to.

Does the encryption of Microsoft Office guarantee integrity of the saved data?

PS: I already read this question, but it is only concerned with confidentiality.

Improve this question
3
  • Integrity in what sense? The only way to meaningfully change the document is to decrypt it, which would require the original key, at which point you could reencrypt it. You can still MAC with a symetric key, which is likely done, although the only other attack would be to randomly mutate the encrypted document, which is going to result in a "corrupted" document.
    – Clockwork-Muse
    Commented Nov 29, 2018 at 22:48
  • That is a common miunderstanding. In particular the CBC mode is vulnerable to such attacks. The most pupular and recent example for this is the EFAIL attack: efail.de
    – Dave
    Commented Nov 30, 2018 at 8:12
  • Ah, I see what you mean about being able to use CBC to insert attack text.
    – Clockwork-Muse
    Commented Nov 30, 2018 at 17:33

1 Answer 1

Reset to default
2

Based on the latest MS Office spec, "agile encryption" uses a SHA1-based HMAC for message authentication:

https://interoperability.blob.core.windows.net/files/MS-OFFCRYPTO/[MS-OFFCRYPTO].pdf

Office 2016 appears to use agile encryption by default:

https://docs.microsoft.com/en-us/DeployOffice/security/cryptography-and-encryption-in-office

Improve this answer
1
  • Sorry it took me so long to accept this answer. Nevertheless, this was exactly what I was looking for. Thank you!
    – Dave
    Commented Apr 14, 2019 at 11:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .