Ah, the immunisation-Matryoshka-doll-possibilities are endless :D
So in this scenario where they add a magic string:
1) Would this magic string be constant?
2) Would this magic string be from some generative algorithm
3) Could this magic string be random?
See the similarities between the original scenario and this one?
I guess if they were sincerely hardcore they could use a MAC on the exposed "magic string", though to do that correctly, they'd need to embed that within the actual encrypted payload, otherwise they'd be subject to the same immunisation attack of just prepending a valid, MAC'd magic-string to files when they were requested through a file handler API. Or they could use something like AES-GCM or some other authenticated encryption, though they'd have to run the decryption algorithm on every file to obtain the AAD)
So in this scenario where they add a magic string: 1) Would this magic string be constant? 2) Would this magic string be from some generative algorithm 3) Could this magic string be random?
See the similarities between the original scenario and this one?
I guess if they were sincerely hardcore they could use a MAC on the exposed "magic string", though to do that correctly, they'd need to embed that within the actual encrypted payload, otherwise they'd be subject to the same immunisation attack of just prepending a valid, MAC'd magic-string to files when they were requested through a file handler API. Or they could use something like AES-GCM or some other authenticated encryption, though they'd have to run the decryption algorithm on every file to obtain the AAD)