Not necessarily. You can add auth at the encrypted block level: https://peergos.org/posts/bats