Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I want to provide both confidentiality and integrity for data at rest (many large files stored on disk).

I plan to encrypt the data using AES, which will cover the confidentiality requirement.

So the issue is how to provide integrity:

  1. Instead of AES, use AES-GCM-SHA256 (authenticated cipher). My understanding is that this produces an HMAC (keyed hash) of the encrypted data (and IV), and appends it to the end of the file

  2. After encrypting each file, produce an RSA digital signature and either save it as a seperate file or append it to the encrypted file

What are the merits and disadvantages of each option?

share|improve this question
    
By AES-GCM-SHA256, do you mean a scheme that uses a SHA256 based KDF, as in RFC 5288 specifying AES-GCM cipher suites for TLS? –  Henrick Hellström Apr 2 '13 at 23:11
    
@HenrickHellström Yes, I just mean AES cipher in GCM mode using SHA256 hash. Is there a different notation I should have used? –  MurrayA Apr 3 '13 at 17:12
    
AES-GCM does not use a SHA256 hash, as has been told in both answers and some comments. However, you might for some reason need to pass your key material through a KDF to generate the actual AES-GCM key before you instantiate AES-GCM, and that KDF might be based on SHA256. Is that what you mean? –  Henrick Hellström Apr 3 '13 at 17:18
    
@HenrickHellström maybe I have misunderstood how AES works in GCM mode then - I thought it basically did the same job as if I used AES encryption in CBC mode and then applied an HMAC, such as HMAC-SHA-256, except it did it all in one cryptographic primitive? –  MurrayA Apr 3 '13 at 21:01
    
That is AES-CBC-then-HMAC-SHA-256. AES-GCM is technically AES-CTR-then-GHASH. –  Henrick Hellström Apr 4 '13 at 6:51

2 Answers 2

up vote 4 down vote accepted

You got some notation wrong. There is no algorithm like "AES-GCM-SHA-256".

AES is a block cipher, i.e. a pseudorandom permutation of 128-bit blocks. It itself only allows encryption for messages of size 128 bits (= 16 bytes), with a limited security guarantee.

When you mean "encrypt the data using AES", you actually mean "use AES with some mode of operation to encrypt the data".

Galois/Counter Mode is one such mode of operation, which combines counter mode for privacy and a block-cipher based MAC (GMAC) using some finite field operations and some block cipher calls for authentication.

SHA-256 is a hash function, but neither it nor its associated HMAC function HMAC-SHA-246 are used here in any way.

When using GCM (or almost any mode) for disk encryption with changing files, you should pay attention: You shall not use the same key and initialization vector (= initial counter) twice for different data. This also means, don't simply change some parts of the file an then encrypt again only the changed parts with same initialization vector, as you are then using the same IV twice (over time).

Instead, either generate a new random IV and encrypt the whole file with it, or split the file in blocks (of a comfortable size, e.g. 4 KB or such), each of which is then encrypted using GCM mode with a separate, independent random IV. (This works better if you are encrypting your whole disk – then you would use the disk sector as your encryption unit.)

There is no point of using a signature – that only makes sense if you want to allow someone else to prove that you did produce (or at least sign) the data, without this one being able to produce it himself.

share|improve this answer
    
Regarding signatures, it isn't part of my requirements now, but for the sake of argument let's say I wanted external auditors to be able to verify the authenticity of thr data - would signatures then become a good option? –  MurrayA Apr 2 '13 at 20:01
2  
It might become, but then you should have a look on what you are to sign – the ciphertext (the auditors only can verify that you produced something, without knowing what), or the plaintext – then it can't be verified anymore without decrypting first, and the auditors also need the encryption key. –  Paŭlo Ebermann Apr 2 '13 at 20:04
    
Good points, thanks –  MurrayA Apr 2 '13 at 20:11

Your options should really be either using GCM mode, or using a non-authenticated mode (such as CBC) and calculating the HMAC (with something like HMAC-SHA256) post-encryption. Using an asymmetrical encryption scheme such as RSA in this context is not very efficient or appropriate.

GCM is a good option as it combines encryption and integrity in one mechanism. You're right, GCM produces a keyed digest of the ciphertext and appends it, and also validates it upon decryption. The advantages are that you only have to worry about one key, and there's less room for error. Just a note regarding your terminology, I'm not aware that you can specify the hash algorithm (ie, AES-GCM-SHA256) for GCM mode, but I may be wrong.

The second option, encrypt-then-hmac, is fine too, but there's more room for error. I guess the advantage is that you can specify your own hash algorithm (such as SHA512, Keccak, or whatever), which may be advantageous if you're ultra-paranoid about security.

share|improve this answer
    
Why wouldn't the RSA option be appropriate? I realise it would be slower than either AE or HMAC, but I'm not too concerned about that (it would afterall only be signing a hash of each file) –  MurrayA Apr 2 '13 at 19:52
    
@MurrayA: An asymmetric signature (like RSA) is useful only when you have different persons doing signing and verification. I don't see this being the case here. –  Paŭlo Ebermann Apr 2 '13 at 19:57
    
Sorry about the notation - I just mean AES cipher in GCM mode using SHA256 hash :) –  MurrayA Apr 2 '13 at 19:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.