I want to send data over the Internet securely. For that, I am using an public key of the receiver to encrypt the data. In this case, if an intruder in the network modifies the data, like placing the bits by rotating, can I decrypt the data successfully?

And also I am sending data over the network all the time. If the intruder modifies the data as I mentioned in above method, then how can I send securely?

Also, is this case applicable to all symmetric encryption?


Speaking about encryption in general, not limiting it to RSA, if a man-in-the-middle modifies an encrypted message, the message will not decrypt as the same message you sent. It really depends on the encryption algorithm used. For example, if a block cipher was used, only the block with the altered data will fail to decrypt properly, the rest of the blocks would decrypt fine, though there is no way to tell which was altered. Other types of encryption would just fail to decrypt a message if a byte was altered.

That said, the primary purpose of encryption is to provide confidentiality, as in it's used to ensure the conversation between you and the other party cannot be intercepted and read by anyone else. What you seem to be asking for is a way to ensure the data you sent was unmodified in transit. Encryption can help with that, from simple basic hashing, to utilizing DSA (digital signature algorithm). If you take a hash of your message, place the hash at the end of your message, and encrypt the whole thing, when the receiver gets the message and decrypts it, they can rehash the message and verify it against the provided hash. If they are the same, they can say with near certainty that the message wasn't altered in transit.

Side note - RSA is slow, and usually reserved for tiny-message uses, such as exchanging a symmetric key, or "signing" a hash of a message. It's not normally used to encrypt large messages.

| improve this answer | |

As a rule, encryption provides confidentiality, not integrity. Depending on the algorithm, the attacker may have more or less control on what will show up after decryption.

In any case, we are talking here about RSA, in which encryption uses the recipient's public key. As the name suggests, the public key is public (and keeping it "secret" can be hard). Therefore, an attacker may try to create a data element on his own, encrypt it with the recipient's RSA key, and send that as if it came from the genuine client. If you want to protect yourself against that, then you need some way to distinguish a message sent by the rightful sender, from a fake message sent by the attacker. This calls for authentication.

There are mostly two methods by which you can achieve that kind of authentication, and they both rely on existing protocols and software (and that is a very good thing, because implementing your own crypto is a bad idea which has repeatedly induced disaster):

  1. Make it so that senders also own public/private key pairs, and the sender signs the message he sends. By verifying the signature, the recipient can make sure that the received message is the right one, exact and correct down to the last bit. This is the "signed email" model, so this points at the OpenPGP standard. Supporting implementations are available (e.g. GnuPG).

  2. Establish a secure tunnel between sender and recipient. Within that tunnel, the recipient authenticates the sender (e.g. with a password); then the client sends the message within the tunnel. The tunnel uses cryptography to maintain its integrity even against active attackers. This is the Web/HTTPS model, the tunnel being SSL/TLS. SSL support code is widely available in both client and server software, and stand-alone libraries also exist (e.g. OpenSSL).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.