ciphertext

The problem is that it's usually not true that you can have confidentiality without integrity, because of chosen ciphertext attacks.

A small part of that sequence is used as an authentication key to make the message authentication code using a polynomial function over the ciphertext, the rest is xored together with the message to make the ciphertext.

Assuming we store a SHA256 MAC for the sector's ciphertext, for a 1TiB drive that means storing 64GiB of hashes.

In this case, ciphertexts can be easily decrypted by taking the eth root of the ciphertext over the integers.

This is a chosen ciphertext attack, so yes, you have to decrypt the attacker-provided payload.

You generally don't want to trust the confidentiality of a cryptosystem that doesn't check ciphertext integrity and rule out manipulated ciphertexts.

With end-to-end encryption, even upon demonstrating probable cause to a judge and having a warrant issued, he's still looking at ciphertext.

Sound cryptosystems that provide integrity checking rule out chosen ciphertext attacks against the cipher: in order to submit a ciphertext to such a system, you have to get past a cryptographically secure integrity check.

I realize that two identical plaintext messages will result in identical ciphertext, but in this application that is OK.

But if you MAC and then encrypt, you concede to attackers the ability to target the cipher's decryption operation directly with chosen-ciphertext attacks.

First, I suspect it's lacking a secure integrity check (MAC), so is weak against chosen ciphertext attacks.

So, to the best of my knowledge, Linux/encfs/SimpleBackup act as I expect them to, backing up only the ciphertext.

It took awhile for it to "click" with me why the "repeated ciphertext" condition 'agl talks about in the first example is so bad.