https://srdusr.com/tags/cryptography/Recent content in Cryptography on srdusrHugoen-usSun, 30 Aug 2026 23:11:47 +0200https://srdusr.com/blog/encryption-is-not-integrity/Fri, 27 Feb 2026 00:00:00 +0000https://srdusr.com/blog/encryption-is-not-integrity/<p>Encrypting data hides it. It does not prove the data was not changed. These are two different properties, and assuming the first provides the second is the root of a whole class of real vulnerabilities.</p> <h2 id="why-it-holds">Why it holds</h2> <p>A cipher maps plaintext to ciphertext so an eavesdropper cannot read it. Nothing in that mapping detects tampering with the ciphertext. In CBC mode an attacker can flip bits and, given feedback on whether the result decrypts to valid padding, recover and forge plaintext without the key. That is the padding oracle attack, and it exists precisely because the system checked confidentiality but never integrity.</p>