Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 0 down vote favorite

On a general level, is there any way to ensure that a file has been encrypted? Specifically, is there any way to check this remotely using something like a checksum or key?

Here's a simplified version of my situation: my friend uploads a lot of very large files every day on a remote server. I only have download access to these files and I want a fast way to ensure that they have all been encrypted before I download them to my local machine.

I want them encrypted for two reasons:

  1. No one should be able to read the files except for the original uploader. (In this scenario, they're not mine, I'm just holding onto them.)
  2. I don't want any executables in these files (potential viruses, etc...) to potentially run on my computer. (I may be wrong, but I believe encrypted binaries are a non-threat -- correct?)

Here are a few more, potentially helpful details:

  • The uploader is able to upload additional files for me to download. (Ex: upload some kind of verification key...)
  • I can give him a key of some sort to use in verification. (I'm thinking something like an ssl key.)
  • Hand shaking is ok. (Everything is automated.)

So, is there any way for me to guarantee that these files have been encrypted and that they're safe to download?

Put another way, here's what I'd like to do:

  1. My friend uploads a lot of very large files to his server. (Could be executable, images, viruses, whatever.)
  2. He encrypts them, and creates a verification key. (Or something.)
  3. I download the verification key for the file and check it against the one I gave him.
  4. The file checks out, and I'm now sure that the file to be downloaded is encrypted.

I'm 99% new to cryptography, but I've always wanted to get into it. (This is my chance!) If I'm missing any basic concepts here, I would really appreciate references to good intro material to start my crypto education.

Thanks everyone!

share|improve this question
1  
An encrypted or unencrypted binary is only a threat if you run it. By itself, it cannot harm your computer. The only difference is that if the contents of, say, program.exe are encrypted, double-clicking it will give you a message that it cannot be executed. – Bruno Reis Oct 10 '12 at 3:15
Also, I don't really understand the threat. If the file is uploaded unencrypted, then your verification seems useless, since the file could already have been stolen (by someone eavesdropping the upload). – Bruno Reis Oct 10 '12 at 3:17
You're totally right that an unencrypted upload would be vulnerable. However, in my case the files are actually generated by the server. (I've simplified the situation substantially just to keep the question manageable.) I'm just trying to find if there's a way that I can ensure that the remote files are actually encrypted without downloading them and inspecting them on my local machine. They are encrypted automatically server-side, and I want to double check that things haven't been tampered with - a double safety net kind of. – Loren Rogers Oct 10 '12 at 5:16
I still can't understand what you are trying to protect from. You say there's no problem on eavesdropping during upload (simply because you say there's no upload). Are you afraid of someone eavesdropping your download? If so, install a webserver with authentication and HTTPS (Apache, for instance) and download the files: only you will be able to download (authentication) and no one will be able to eavesdrop (HTTPS). Or you could use SFTP, etc. – Bruno Reis Oct 10 '12 at 5:22
2  
This is tricky because there is a good chance your system will be vunerable to a TOCTOU attack. You check that everything verifies with the files. Then a malicious server replaces the files with unencrypted viruses, etc. You download the changed files. – mikeazo♦ Oct 10 '12 at 11:43
show 5 more comments

closed as not constructive by mikeazo♦ Oct 12 '12 at 11:53

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.