Symmetric algorithms such as AES provides modes such as GCM which can be used for authenticated encryption. Assuming that I'm using RSA instead of AES, does it still make sense to add authentication checks based on HMACs to encrypted data?

[EDIT] The usecase is that I'm to store data on a machine and wish to encrypt it. I can choose between RSA and AES, however, verifying its authenticity(whether or not its been tampered with/replaced etc) before or during decryption is important.

  • Would you like to be more specific about what exactly you are authenticating? Im slightly confused as to which technology to answer your question with
    – user11869
    Dec 6, 2012 at 6:02
  • Authentication to make sure that the data is not tampered with at rest.
    – user1187
    Dec 6, 2012 at 6:38
  • 2
    You normally don't use RSA instead of AES, you use it in addition to AES. If you don't describe what you're doing and even more importantly what the security goals are, we can't really help you. Dec 6, 2012 at 7:18
  • 1
    Having the choice between AES and RSA is weird. In the places where RSA is a good choice, AES doesn't work because it's symmetric. My suggestion is to either use RSA-Enc + AES + MAC or RSA-Enc + AES + RSA-Sig. But your description is still extremely vague. How large is the data? Why do you need asymmetric encryption? Should a third party be able to verify the integrity but not be able to decrypt?... Dec 6, 2012 at 10:08

4 Answers 4


You do not normally encrypt data with RSA. What you do is that you encrypt a random key with RSA, and then you encrypt the data itself with a symmetric encryption algorithm (such as AES), using the random key. This is called hybrid encryption. The main reason why this is so is because RSA encryption is very limited in size: with a 1024-bit RSA key, you can encrypt at most 117 bytes, no more.

So, there is necessarily some symmetric encryption in the process (unless you are doing it wrong, or the data to encrypt is very short) and that part should include an integrity check, which is what GCM or EAX provides along with the encryption.

Anyway, regardless of the way you encrypt the data, you need an integrity check and RSA, by itself, will not provide it. Since assembling several cryptographic algorithms is a difficult task (it is easy to get it wrong), you really should rely on a library which does the work for you and has been reasonably verified to do things correctly (e.g. GnuPG).


I don't really know what's the problem ? If you want secrecy you use encryption if you want authenticity you use Digital Signatures, and in the same regard integrity. If you sign a Hash(RSA) either before or after encryption (AES). It depends on when you want to validate its integrity.


Just a suggestion:

You can first try to generate hash of the data using any well known Hash Algorithm (Ex: SHA-256) and then append the hash to the end of data and encrypt both the data and the hash with a symmetric algorithm (AES).

You need work out a way to keep track of where your data ends and where the hash begins (You can record the lengths at the beginning of the block)

When you retrieve the data, first decrypt it, then generate the hash of the data part again and verify it with the hash present before. This will help with both Integrity and Confidentiality. The approach is somewhat similar to the way TLS protects it's records.

Pls note that this doesn't provide authentication (It provides a way to check the authenticity of the data though) which I assume is not needed for you.

Hope this helps.

  • 1
    That approach is generally discouraged. Generally authenticated modes (AES-GCM, etc.) or Encrypt-Then-MAC are preferred. Dec 6, 2012 at 10:05
  • @CodesInChaos, Why is Encrypt-Then-MAC preferred then MAC-Then-Encrypt? I am not clear on this.
    – Jay
    Dec 6, 2012 at 10:20
  • You can use Encrypt-Then-MAC, but you have to be more careful designing the scheme. There are combinations, such as MAC then encrypt with AES-CBC that have weaknesses. See Should we MAC-then-encrypt or encrypt-then-MAC? on crypto.SE for details. Dec 6, 2012 at 10:27

As you note, when referencing GCM there are a number of ways to do encryption plus authentication at the same time: Authenticated Encryption with Associated Data or Authenticated encryption. This should provide both at once and nicely sidesteps the issue of whether you should authenticate and then encrypt or encrypt and then authenticate.

For the benefit of people reading some of the other comments, the consensus, though is that if you must use one and then the other that encrpyt then authenticate is better from a cryptographic doom point of view.

If it's just for backup I don't see the use case for using public keys, it seems to make things more complicated, unless you have a turn-key solution.

You must log in to answer this question.