Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose I am building an encrypted document storage system. Suppose each user has a "user key": a symmetric key. Suppose each document is encrypted with a "document key". So, in order to give a user access to a document, we store a tuple of (user_id, document_id, encrypted_doc_key) where the encrypted document key is encrypted using the user key. In this case, is there an appreciable difference in encryption modes?

The plaintext would be 1-2 blocks long, and random. Every time data is encrypted or decrypted, the entire thing is needed, so the ability to decrypt arbitrary blocks is not necessary. Even ECB seems like it should be relatively secure here, but I'm thinking using something with a random IV would be a better option. Given that the data being decrypted (the wrapped keys) shouldn't be able to be modified by an attacker, I'm not as concerned about authentication.

Is there an existing protocol that does something like this?

share|improve this question
1 $\;$ – Ricky Demer Jul 17 '13 at 5:16

You can use a key wrap scheme. Frankly, any authenticated encryption mode would probably be fine, but a key wrap scheme is designed for exactly this purpose: encrypting one key under another key. So, you might as well use one of the accepted key wrap schemes.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.