Is the statement true in the context of AES-256 encrypted data stored on a hacked server? I'm writing a document and I am making an important statement in it, which may be used for strategic decision regarding data-management (possibly from never handling sensitive information online to allowing some to be). I am certain of that statement, however I would like encryption specialists to confirm, infirm or precise it. This is the statement:


  Important note: as long as the data on the server (name of platform) is encrypted and the decryption key safely stored elsewhere according to protocols established, it does not matter (from an access to the data perspective) if the account on the server is hacked. In that case the real protection for the data is the encryption, not the server itself, although it does act as an additional layer of security.


Context: The data is encrypted on a local device and submitted (encrypted) on to the application on the server. It is then downloaded by users (still encrypted) to be decrypted locally using the key. We are talking about AES 256 bits encryption using CFB. The statement does not concern data management by users (e.g. their handling of the key, as it does state that it assumes this is done properly) and does not concern the mobile devices used to created/encrypt/submit the data (this is addressed separately).

I am aiming at being as precise as possible (e.g. I don't want it to be generic hog-wash more aimed at protecting the writer than helping), but I want to be certain of what is written.

So the question is: Is the statement true in the context defined? If it is not or should be nuanced/modified, what should I change? 

EDIT: (The reworded statement according to provided answer below):


  Important note: as long as the data on the server (name of platform)
  is encrypted and the decryption key safely stored elsewhere according
  to protocols established, it does not matter from a data confidentiality
  perspective if the account is hacked, although in that case data
  integrity is not guaranteed. The real protection for confidentiality of the data  is
  the encryption, not the server.
Important note: as long as the data on the server (name of platform) is encrypted and the decryption key safely stored elsewhere according to protocols established, it does not matter (from an access to the data perspective) if the account on the server is hacked. In that case the real protection for the data is the encryption, not the server itself, although it does act as an additional layer of security.


Yes and ... No.

Could you define what do you mean by access to the data perspective ? By whom ?

You need to have a clear definition of the properties you want to guarantee. In cryptography there are 3 essential properties.

confidentiality: only the authorized users can read the data (and understand it).

integrity: the users have the guarantee that the data have not been modified, or in other words only the authorized users can modify the data.

authenticity: the users have the guarantee that the data/entities are who they are (this is different from identification).

In the case you are talking about, you only implies that you are providing confidentiality but no integrity. In other word, an attacker could access the data, not be able to read it but could still modify it. Note also that the property access to the data perspective is not provided anymore to the authorized user in the case where the data have been modified.

Thus in my opinion, you should slightly improve the text to say that you don't provide the integrity in this case (or use an Authenticated Encryption Scheme). It might also be a good idea to use the vocabulary previously defined (confidentiality and integrity).