I'm trying to understand the CIA triad. I read that all three parts of the triangle exclude each other, but I don't understand why you can't have full integrity and full confidentiality? I figure you get integrity with encryption and maybe some other restrictions, but how does that hurt confidentiality?


  • 6
    Where did you read that they exclude eacn other? – Graham Hill Nov 4 '14 at 11:35
  • 3
    It would help if you included a link to where you read they exclude each other (I can't see this being mentioned in the link you provide), but perhaps it's also more of a question for the author of the article you read. For more info on the CIA Triad refer to a related post in our blog. They're (arguably) three core components of IT security, so they're supposed to be approached in conjunction. Claiming otherwise would have to be explained by its author, not us. – TildalWave Nov 4 '14 at 11:37
  • 2
    @GrahamHill I'm taking a class at HIST, a norwegian school, and I got this assignment: "explain why all three parts of the cia triad are contrary to each other and need to be weighed against each other". The assignment is in norwegian so my translation might not be 100 percent, but I will consult the teacher about it and post back. – hansn Nov 4 '14 at 14:07
  • 3
    @hansn This explanation is is a complete over-simplification of the concepts. It is so simple, it's wrong. – schroeder Nov 28 '14 at 21:12
  • 3
    @hansn No. It really, really doesn't matter. – schroeder Nov 28 '14 at 22:56

You can have both integrity and confidentiality. There is no such "exclusion". However, you must remember that they are different things provided by distinct algorithms. Piling layers of encryption does not provide integrity.

Integrity is normally obtained with a MAC, while confidentiality relies on encryption. Combining encryption and a MAC algorithm properly is known to be tricky; e.g. SSL/TLS got it wrong and it generated an endless stream of attacks that can be thwarted only with extreme care in their implementation.

| improve this answer | |
  • Just because I'm pedantic, and I know you know this, but for the reader: new encryption modes like GCM do provide confidentiality. The old saw that encrypting data does not prevent changing that data has some rust – atk Nov 5 '14 at 1:48
  • @atk But that's not because the data is encrypted, it's because GCM incorporates a MAC (the tag) on top of the encrypted data. It's the same model, it's just that the MAC is now a mandatory component of the implementation. – Xander Nov 5 '14 at 14:40
  • @Xandar, Absolute correct :-) The GCM ebcryption mode includes data integrity via a MAC/hash. However, it's still called an encryption mode, which 'weakens' (for lack of a better word) the statement that 'encryption doesn't provide integrity.' Or maybe better stated, it blurs the lines so they are no longer as brightly drawn, in the eyes of the nonexpert. – atk Nov 5 '14 at 16:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.