Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was working with some encryption and I decided to put a spin. To preface this would be used to encrypt multiple files.

You start with a key file generated from random data. For example you could generate a 288 byte key file. This file contains 9 sub-keys each 256-bits.

For each file to encrypt you securely randomly select a sub-key from the file. Then you create the header by append 28 bytes of random garbage bytes onto 4 bytes which is the index of the sub-key in the key file. You then use the first sub-key to encrypt this 32 byte header block.

The remainder of the file is encrypted using the sub-key and is placed after the header.

I was wondering if there are any obvious flaws to this approach. My nuonce is going to start at zero.

Would it also be even better to start the nouce using the first byte of the key?

share|improve this question
up vote 2 down vote accepted

I would advise a different solution.

You either generate a master-key (or key set) or derive one from a user password (e.g. via PBKDF2 or SCrypt). For each file to encrypt you generate a random key (file key) and nonce ad-hoc, and encrypt the file with that key, using an AEAD scheme.

The random file key is encrypted with you master key and put at the beginning of the file. Preferable you should include that encrypted key as authenticated data within the AEAD scheme.

The steps:

  1. Generate random file key and nonce
  2. Encrypt file key with master key (using a key-wrap spec.)
  3. Encrypt the plaintext file data with the file key and using it enc. form as part of the authenticated data (AEAD scheme)
  4. Store nonce, enc. file key and encrypted data as the enc. file

Your solution is dangerous. Using the same nonce with the same key (you only have 9 or so) to encrypt different data will allow an attacker to retrieve information concerning the plaintext data.

share|improve this answer
Yes, your idea is much better indeed. It makes sense just to go ahead and generate a random (sub-key as I called it) and use that and also go ahead and use a random nonce. – kmcguire Jul 20 '14 at 21:57
What's the advantage of random file keys here, as opposed to using the master key with a unique IV? – otus Jul 21 '14 at 9:40
I am not an expert, but I had hopes it do two things. Not reduce the security and increase the security. Not using master key I felt make attack hard being unable to infer key used and nonce. The master used less frequently so if plain-text weakness in AES or any block cipher it would be hard guess sub-key. If the attack guess the plain text of the data and able to determine the key he would have to do the same for all other files, and if there was a weakness in using a nonce then maybe that would prevent that also being that a different key is used. I was just trying to layer more security. – kmcguire Jul 21 '14 at 14:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.