How to handle the problem of modified encrypted files

Question

I have a simple encryption/decryption application that I am testing to learn more about security. I found out that if the user modifies the encrypted file, then decryption fails because the hashing algorithm doesn't generate back the original content. What are the common practices that deal with the problem of encrypted files modified by users either intentionally or unintentionally? The only thing I can think of is timestamp checking, but I am not sure how useful that is.

About my last statement, I guess I am not sure if there is a way to trick the OS so that the new timestamp is set back to the exact old time stamp although the content is modified.

Answer 1

Well, any file altered after encryption is going to generate funny results. The only way I would know of detecting such changes would be to store a hash of the encrypted file when you do the encryption, and then compare that hash to the hash of the encrypted file prior to decryption. If there are any changes, the hashes will mismatch, and you'll know that the encrypted file isn't going to return the original results.

Don't rely on file stamps, though; timestamps and other metadata can change simply by moving a file around (either by the user or other processes). (Furthermore, timestamps and metadata can always be changed back, thus fooling the check.)

Answer 2

Cryptographically sign the file content, for instance using MD5.

The MD5 Message-Digest Algorithm is a widely used cryptographic hash function that produces a 128-bit (16-byte) hash value. Specified in RFC 1321, MD5 has been utilized in a wide variety of security applications, and is also commonly used to check data integrity... An MD5 hash is typically expressed as a hexadecimal number, 32 digits long...

Answer 3

• Remove redundancy by applying compression on the plaintext before encryption
• Encrypt
• Add error-correction blocks to the encrypted datastream.

These three things must be done in this order. They cannot be switched around.

Answer 4

I strongly suggest you get the book "Applied Cryptography: Protocols, Algorithms, and Source Code in C" by Bruce Schneier.

This is a big fat (and expensive) book, which covers everything from simple introductory concepts through to the complex and ugly.

Even if you only read the first 100 pages, you will have a much better appreciation for the problems you will strike.

As a rough rule of thumb: If you think you know about cryptography - check with an expert :)