Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Encryption can keep data secret without revealing that it was changed. To detect tampering, use authenticated encryption—or a separate, properly keyed authentication mechanism—and verify it before trusting the data. A successful check is strong evidence of integrity, not an absolute guarantee.
Does encryption detect tampering?
Not necessarily. Encryption and integrity protection solve different problems: encryption is like putting a message in an opaque envelope, while authentication adds a tamper-evident seal the recipient can check. Some encryption modes protect confidentiality without authenticating data. NIST, for example, describes XTS-AES as a storage-device mode designed for confidentiality without authentication in its overview of block cipher modes.
That means a file being encrypted—or decrypting successfully—is not, by itself, proof that nobody altered it. A lock icon or encrypted file extension does not establish integrity either.
What does an authentication check add?
Authenticated encryption protects confidentiality and checks integrity together. In GCM, the sender produces an authentication tag using secret key material. The recipient checks the tag against the protected data and any associated data before accepting the decrypted result. NIST specifies GCM as authenticated encryption with associated data, and GMAC as an authentication-only mode, in SP 800-38D.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
Associated data is information that remains visible rather than encrypted but is bound to the protected message by the authentication check. This can be useful for metadata that need not be secret but must not be changed unnoticed. If authenticated decryption returns a failure, NIST says at least one supplied input—the ciphertext, associated data, IV, or tag—is not authentic. The application should reject the result, not use plaintext from a failed or skipped check. See SP 800-38D, Appendix B.
Which protection fits the job?
| Approach | Confidentiality | Cryptographic change detection | When it may fit |
|---|---|---|---|
| Confidentiality-only encryption mode | Yes, when correctly used | Not necessarily | When confidentiality is the intended protection; add integrity protection if alteration must be detected. |
| Authenticated encryption, such as GCM | Yes | Yes, through tag verification | When data must be both kept secret and checked for unauthorized changes. |
| Authentication-only mode, such as GMAC | No | Yes, subject to key and construction assumptions | When data need integrity/authenticity protection but do not need encryption. |
These are mechanism categories, not interchangeable settings for every system. NIST’s mode overview covers multiple standardized modes; the right choice depends on the protocol and requirements.
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
How should you check data integrity in practice?
- Use a documented authenticated-encryption interface. For a new application, choose a standard API in a well-maintained cryptographic library that fits the protocol. Do not invent a construction or casually combine encryption and hashing.
- Bind relevant metadata. If visible fields must remain tied to the ciphertext, use the API’s associated-data facility where appropriate. The receiver must supply the corresponding data during verification.
- Verify before acting on plaintext. Treat authentication failure as a hard failure: do not display, store, execute, or otherwise consume plaintext from an unsuccessful check.
- Follow the implementation’s key and IV/nonce rules. NIST’s GCM guidance emphasizes IV uniqueness and discusses tag-length concerns. Parameter choices and failure handling are implementation-specific; consult the standard and the library’s documentation rather than copying a generic configuration.
What does a valid tag prove—and what does it not?
A valid tag gives strong assurance that the checked inputs have not been altered without the relevant key, under the construction’s assumptions. It is not an absolute guarantee: forgery is possible in principle, and NIST explains that tag length, message volume, and repeated unsuccessful verification attempts affect assurance in SP 800-38D.
Authentication also does not necessarily identify a human sender. With a shared secret key, a valid check establishes that the data are valid under that key; it does not by itself prove which person created them or provide non-repudiation. A tag likewise cannot establish that a message is truthful—only that the authenticated inputs pass the check.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
What guidance should implementers consult?
NIST SP 800-38D, published November 28, 2007, specifies GCM and GMAC. NIST has decided to revise it; the revision status page records a second pre-draft call for comments published June 1, 2026, with a July 31, 2026 deadline, and says no actual draft document was available at that stage. The final publication remains the finalized guidance to consult for GCM and GMAC. Broader federal guidance on cryptographic mechanisms is in NIST SP 800-175B Rev. 1, published March 31, 2020.
Quick Recap
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
