Ensuring integrity and confidentiality together with symmetric encryption I've been required to answer a question:

As usually, we have Alice and Bob.
Suppose Alice wants to send a file F to Bob, ensuring integrity and confidentiality. They share a symmetryc key $K_{ab}$ and use AES. No hash algorithm is available.
Alice sends to Bob: $Enc(K_{ab}, F)$
In this simple scheme, are integrity and confidentiality guaranteed?

My answer:

Confidentiality is guaranteed if we use CBC (cipher block chaining) for example. But this is obvious. If we use a symmetric encryption algorithm as AES we have to use CBC, CFB, OFB or whatever.. right? So this answer seems too simple.

I would say that a computer is not able to tell if the message has been tampered with. So i would use CBC along with a &quot;weak&quot; cryptographic checksum inside CBC. A longer non-cryptographic checksum is suspect and subtle attacks are known if CRC is short.

Use OCB (Offset Codebook Mode). This mode of operation get both encryption and integrity protection while making only a single cryptographic pass over the data.


Are these answers correct? Could you give some background why the are correct or not?

P.S.: I could get privacy of a message with CBC encryption and integrity with CBC residue as long as the two are computed with different keys, but this requires twice the cryptographic power of encryption alone.
Do not invent your own authenticated encryption mode. Use a standardized one, and use a well-supported library to implement it in your code.

AES-GCM, AES-CCM, AES-OCB, and AES-CBC with HMAC-SHA256 over the ciphertext are all common options.

Some great direction from Matt Green here: How to choose an Authenticated Encryption mode