Why does encryption alone NOT provide data integrity, and what additional mechanisms are needed?
Encryption only provides confidentiality — an attacker can modify ciphertext without detection. Integrity requires separate mechanisms: MAC (symmetric), digital signatures (asymmetric), or authenticated encryption (GCM).
The misconception: "If I encrypt my data, nobody can tamper with it." — FALSE.
Why encryption fails at integrity:
- Stream ciphers/CTR mode: Flipping a bit in the ciphertext flips the corresponding bit in the plaintext — targeted modification without knowing the key
- RSA: Multiplicative homomorphic property allows meaningful ciphertext manipulation
- ElGamal: Same multiplicative manipulation possible
- CBC mode: Predictable bit-flip effects in the following block
Mechanisms for integrity:
| Mechanism | Type | Provides |
|---|---|---|
| HMAC | Symmetric (keyed hash) | Integrity + authentication (not non-repudiation) |
| CBC-MAC / CMAC | Symmetric (block cipher) | Integrity + authentication |
| Digital Signature | Asymmetric | Integrity + authentication + non-repudiation |
| AES-GCM | Authenticated encryption | Confidentiality + integrity in one operation |
AES-GCM is today's most common choice: it folds encryption and authentication into one operation, avoiding the pitfalls of hand-combining a separate cipher and MAC. Earlier attempts to build integrity into the mode failed — PCBC (used in Kerberos v4) had a weakness that sent Kerberos v5 back to plain CBC. GCM itself is not the last word: it has known sharp edges (e.g. catastrophic nonce-reuse), so the CAESAR competition (Competition for Authenticated Encryption) was run to find successors — its winners ACORN and AEGIS are being adopted over time.
Key rule: Always use authenticated encryption (AES-GCM, ChaCha20-Poly1305) — never raw encryption without integrity protection.
Go deeper:
Authenticated encryption (Wikipedia) — why confidentiality and integrity must come together (AEAD).- Galois/Counter Mode (Wikipedia) — how AES-GCM works and why nonce reuse is fatal.