Why does Laravel need a message authentication code (MAC) for it's Encryption?

Question

Laravel documentation says

All of Laravel's encrypted values are signed using a message authentication code (MAC) so that their underlying value can not be modified once encrypted.

In practice it means that the payload is accompanied with a little hash value. It is not a secret of how this value is generated because Laravel is an open source product. The source code says this:

    // Once we get the encrypted value we'll go ahead and base64_encode the input
    // vector and create the MAC for the encrypted value so we can then verify
    // its authenticity. Then, we'll JSON the data into the "payload" array.
    $mac = $this->hash($iv  = base64_encode($iv), $value);

I personally don't see the benefit of this MAC for Laravel. Why is it there?

I mean, if we already have public key that goes along with the message and the private key hidden somewhere and openssl_encrypt as a processor. How MAC can contribute to the security? Or does it contribute to something else?

Answer 1

as James K Polk said

A MAC uses the key, so an attacker cannot generate a correct one unless he has the key.

A MAC is needed to protect against intentional ciphertext modification.

Answer 2

There was a security issue in Laravel 3 where you could gain access as an authenticated user. Although this seems to be more cookie related (you could somehow forge them), but MAC was added then to the cookies.

http://joncave.co.uk/2012/10/lying-to-laravel/

TLDR In the future, it would be good to see Laravel’s Crypter class have MACs built in so that all encrypted messages are verified before decryption. Examples of this type of behaviour can be seen in Zend Framework 2 and Ruby on Rails.

https://laravel3.veliovgroup.com/docs/changes#3.2.8

This is because, decryption can be done with brute force, adding a MAC means you would do nothing if it doesn't matches what it should. The exact implementation of Laravel, i don't know how much security can add, but at least makes things harder for an attacker.