0

I am using OpenPGP and sending a signed, encrypted file with forced MDC (Modification Detection Code) over the network.

In typical file transfer scenarios where security is not in picture, an md5 checksum of file being transferred is sometimes sent along with the original file which can be useful for error detection by comparing checksums.

With signed, encrypted files with Modification Detection Code, process of decryption will immediate tell us if the file has been modified, whether accidentally or maliciously, because message integrity check would fail. With this feature of such encrypted files, is there still any benefit of sending checksum of the encrypted file along with the file?

Note: For Modification Detection Code, see https://www.rfc-editor.org/rfc/rfc4880#page-51

Improve this question
4
  • 1
    The only real benefit I see is that the checksum can be checked before decrypting the contents, meaning it doesn't need to bother wasting CPU cycles decrypting a bad file - but extra CPU cycles could easily be a trivial thing depending on your needs
    – user2813274
    Aug 14, 2014 at 20:54
  • Thanks for your response. Wasted CPU cycles could be considered a potential reason to keep MD5. If it turns out that transmission channel is reliable enough and 99% of all transmissions are not corrupted, then the extra CPU cycles spent in calculating MD5 and comparison would partly offset that. But I do see your point. Thanks again.
    – MickJ
    Aug 14, 2014 at 21:42
  • crossposted from crypto.SE less than than 4 minutes after it was posted there, without that fact having been mentioned on either site
    – user49075
    Aug 14, 2014 at 22:12
  • @user2813274: To protect against non-malicious changes, CRC32 would be far more efficient than MD5. And for malicious attacks you already have MDC.
    – MSalters
    Aug 14, 2014 at 22:22

2 Answers 2

Reset to default
1

The MDC spec allows you to request a specific hash. The default, MD5, is now considered deprecated. All MDC implementations are required to support SHA-1. You can also request SHA256 or SHA512.

Assuming you have a sufficiently secure hash in use with MDC, there's no reason to attach another.

Improve this answer
1
  • Thank you for your clear explanation. I appreciate your help.
    – MickJ
    Aug 15, 2014 at 14:58
0

In a – more of theoretical nature – attack described by Jallad, Katz, Schneier in 2002, the MDC would prevent the attack, no matter whether an additional signature is applied or not.

The Attack

The attack boils down to the fact that encrypted data tampered with will not necessarily fail during decryption (in a sense that the implementation shows a meaningful error message), but might just print garbled output. A recipient misused as a decryption oracle decrypts the data now, but only sees a broken message. If he by accident replies the garbled message as unencrypted full quote to the sender ("I couldn't read your mail, please resend" or something like that), the attacker would intercept the message again and remove the applied encoding from the garbled message.

For details read the paper linked above.

How the MDC Does Help

How relevant the attack is or not: it definitely is a use case for MDC, as a signature wouldn't even help (as it is inside the tampered encryption package and cannot be read). The MDC would already lead to a failed decryption step.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .