06_Integrity_and_MACs — Integrity and MACs — was it changed, and by whom

Level: 201 · working knowledge

Encryption hides a message. It does not stop somebody from changing it. On a stream cipher, flipping a bit in the ciphertext flips exactly that bit in the plaintext — the attacker cannot read the message and can still edit it, precisely.

A MAC is the fix: a keyed tag over the message, which only a holder of the key can produce and anybody with the key can check. That key is what separates a MAC from a plain hash, and it is why sha256(message) appended to a message proves nothing at all.

The pages

#	Page	The question it answers	Status
1	HMAC, and comparing in constant time	Why HMAC rather than hash-then-append — and why is == a bug?	planned

Every page above is a plan until its row says written; see ROADMAP.md.

The through-line

Encrypt-then-MAC, or better, do not compose them yourself. Every ordering people have tried has been broken in some setting; AEAD exists so the question does not have to be re-answered per protocol.