加密能保证完整性吗？
为了构建一个安全的系统，我们可以在开始安全编程之前假设加密保证完整性是真实的吗？
- 无论是对称密钥还是公钥 加密，是我的问题 证明良好？
- 如果没有，有哪些 漏洞，你能给出一个 例子？
To build a secure system, can we assume that encryption guarantees integrity is true before starting a secure programming?
- Both in symmetric and public-key
encryption, is my question
well-proofed ? - If no, what are the
vulnerabilities, can you give an
example?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
不会。如果您考虑一下一次性便笺簿（一个简单的（理论上）完全安全的系统。
如果更改输出的任何位，明文的一部分也会发生变化，而接收者无法检测到这一点。
这是一个显而易见的例子，但同样的结论适用于大多数加密系统。它们仅提供机密性，而不提供完整性。
因此，您可能需要添加数字签名。有趣的是，当使用公钥加密技术时，先签名后加密 (SE) 或先加密后签名 (ES) 是不够的。这两者都容易受到重放攻击。您必须进行签名-加密-签名或加密-签名-加密才能获得总体安全的解决方案。这篇论文详细解释了原因。
如果您使用 SE，收件人可以解密邮件，然后将其重新加密发送给其他收件人。这会欺骗新收件人关于发件人的预期收件人的信息。
如果您使用 ES，窃听者可以删除签名并添加自己的签名。因此，即使他们无法阅读该消息，他们也可以冒充原始发件人，将其归功于此。
No. This is easy to see if you consider the one-time pad, a simple (theoretically) perfectly secure system.
If you change any bit of the output, a bit of the clear text will change, and the recipient has no way to detect this.
This is an obvious case, but the same conclusion applies to most encryption systems. They only provide for confidentiality, not integrity.
Thus, you may want to add a digital signature. Interestingly, when using public key cryptography, it is not sufficient to sign then encrypt (SE), or to encrypt then sign (ES). Both of these are vulnerable to replay attacks. You have to either sign-encrypt-sign or encrypt-sign-encrypt to have a generally secure solution. This paper explains why in detail.
If you use SE, the recipient can decrypt the message, then re-encrypt it to a different recipient. This then deceives the new recipient about the sender's intended recipient.
If you use ES, an eavesdropper can remove the signature and add their own. Thus, even though they can't read the message, they can take credit for it, pretending to be the original sender.
简而言之，答案是否定的。消息完整性和保密性是不同的，并且需要不同的工具。
让我们考虑一个简单的抛硬币，在这种情况下，我们对结果进行投注。结果是一个简单的布尔值，我使用像 RC4 这样的流密码对其进行加密，它产生 1 个加密位，然后通过电子邮件将其发送给您。您没有钥匙，我请您通过电子邮件将答案回复给我。
在这种情况下可能会发生一些攻击。
1）攻击者可以修改传输中的位，如果它是 0，则有 50% 的机会它会变成 1，反之亦然。这是因为 RC4 生成一个 prng 流，该流与纯文本进行异或运算生成密文，类似于一次性密码本。
2）另一种可能性是我可以为您提供不同的密钥以确保您的答案是错误的。这很容易暴力破解，我只是不断尝试按键，直到得到正确的位翻转。
解决方案是使用分组密码CMAC 模式。 CMAC 是类似于 hmac 的消息认证码，但它使用分组密码而不是消息摘要函数。密钥 (K) 与您用于加密消息的密钥相同。这会向密文添加 n+1 个块。在我的场景中，这可以防止攻击 1 和 2。攻击者无法翻转简单的位，因为纯文本已填充，即使消息仅占用 1 位，我也必须使用分组密码传输至少 1 个块。附加的身份验证块阻止我链接密钥，并且它还为任何试图修改传输中的密文的人提供完整性（尽管这在实践中很难做到，但附加的安全层很有用）。
由于这些原因，WPA2 使用 AES-CMAC。
In short the answer is no. Message Integrity and Secrecy are different, and require different tools.
Lets take a simple coin flip into consideration, and in this case we are betting on the results. The result is a simple bool and I encrypt it using a stream cipher like RC4 which yields 1 encrypted bit and I email it to you. You don't have the key, and I ask you to email me back the answer.
A few attacks can happen in this scenario.
1)An attacker could modify the bit in transit, if it was a 0 there is a 50% chance it will become a 1 and the contrary is true. This is because RC4 produces a prng stream that is XOR'ed with the plain text produce the cipher text, similar to a one time pad.
2)Another possibility is that I could provide you with a different key to make sure your answer is wrong. This is easy to brute force, I just just keep trying keys until I get the proper bit flip.
A solution is to use a block cipher is CMAC Mode. A CMAC is a message authentication code similar to an hmac but it uses a block cipher instead of a message digest function. The secret key (K) is the same key that you use to encrypt the message. This adds n+1 blocks to the cipher text. In my scenario this prevents both attacks 1 and 2. An attacker cannot flip a simple bit because the plain text is padded, even if the message only takes up 1 bit i must transmit a minimum of 1 block using a block cipher. The additional authentication block prevents me from chaining the key, and it also provides integrity from anyone attempting to modify the cipher text in transit (although this would be very difficult to do in practice, the additional layer of security is useful).
WPA2 uses AES-CMAC for these reasons.
如果您特别关心数据完整性，则应使用加密哈希函数，结合加密算法。
但这确实取决于使用正确的工具来完成工作。某些加密算法可能会提供某种程度的内置校验和验证，而其他算法可能不会。
If data integrity is a specific concern to you, you should use a cryptographic hash function, combined with an an encryption algorithm.
But it really does come down to using the correct tool for the job. Some encryption algorithms may provide some level of checksum validation built-in, others may not.