Tag Info

29

If it's implemented properly, it is as secure as any other form of encryption in preventing those who don't know the data from obtaining it from the encrypted data. However, it does have one fundamental limitation that, so far as we know, is inherent in the technology -- Anyone who has the same file you have can potentially prove that you have that file. ...

15

People have been aware of the danger of the "confirmation of a file" attack for a long time, since immediately after convergent encryption was first proposed on the cypherpunks mailing list in 2006. However, most people do not appear to appreciate the more subtle danger of the "learn the remaining information" attack (the one that Nakedible alludes to ...

11

By using the file's hash as IV, you also divulge the file's hash. This allows an attacker to make an exhaustive search on the file contents. It is not difficult to imagine situations where there are only a few millions or billions of possible file contents (e.g. the file contents are an encrypted SAN or password), in which case showing the data hash is an ...

8

Assuming that you can indeed guarantee that the keys will never be reused, both schemes should be secure. The only requirement for the nonce in CTR mode is that it must be unique (and, if used directly as the initial counter value, not equal to any intermediate counter value used in the past or in the future). If you're only encrypting one message with a ...

6

A Hash Tree is meant for that. A binary tree seems fit. I'll restrict the description to something directly derived from SHA-256 (256-bits output, 512-bit hashed per round). A parameter n>0 is selected, defining a "superblock" size of n*512 bits. Say 8192 bits (1kB, for n=16); n=1 works, but a higher value improves computing efficiency markedly. The file ...

5

You obviously lose semantic security when you use deterministic encryption. This means an attacker can tell if two files are identical. publishing the unencrypted hash also leaks which file you encrypted, if the attacker knows the hash from elsewhere. You end up with something similar to convergent encryption, which has a few issues. Check the question Is ...

5

The property you want is inconsistant with the definition of a cryptographically-secure hash function. If $\mathcal{H}'(\mathcal{H}(\mathrm{half}_1),\mathcal{H}(\mathrm{half}_2)) = \mathcal{H}'(\mathcal{H}(\mathrm{third}_1),\mathcal{H}(\mathrm{third}_2),\mathcal{H}(\mathrm{third}_3))$, finding second-preimages is as trivial as repartitioning the ...

5

There are a number of zero-knowledge proofs for proving knowledge of a plaintext. These work with public key cryptosystems but not block ciphers. For example, with Elgamal: $\langle g^r, m\cdot y^r \rangle$ it is sufficient to prove knowledge of $r$ in $g^r$. This can be done with a Schnorr proof (and made non-interactive with Fiat-Shamir). As the name ...

4

Well, no, in your case, a constant IV is not a problem. With counter mode, the rule is that you cannot reuse the same IV with the same key. However, it is perfectly fine to use the same IV with different keys, and that's what you're doing. One minor correction to what you have (that doesn't directly relate to your question): you state that there are ...

4

Using the password itself (or anything similar predictable) instead of an independent random value as the salt denies the whole benefit of salt: Same passwords (passphrases) give now the same key, instead a different one. So, if two users happen to choose the same favorite image as their password, they get the same key, and thus an attacker can use this ...

3

It depends on the mode of operation. With counter mode, predictable IV's are fine. Of course, a collision in file hashes would result in easy plain-text recovery. It's probably better to fill the high order 64-bits with the number of microseconds since the unix epoc, pad the rest of the 64-bits with random numbers and the use the low order 64-bits as the ...

2

There is a new theoritical analysis as a new cryptographic primitive, denoted as message lock encryption provided by Mihir Bellare et al to capture convergent encryption. I am updating my answer regarding the paper abstract. The paper models all existing convergent encryption schemes and it gives the first security definitions of a convergent encryption ...

2

In addition to that, there has been specific proof systems whose one of the motivating argument was such a protocol, now more commonly known as Proof of Knowledge. Goldreich in Chapter 4 of his book, Foundation of Cryptography I has even mentioned why in such a scenario, you prefer to have a Proof of Knowledge rather than Zero Knowledge Proof. That said, I ...

2

Not an answer to your question, but a security point. Revealing simple hashes of unencrypted content is a security vulnerability. (Revealing HMACs or anything with a secret component do not pose the same vulnerability, even if they are calculated from the unencrypted content.) For example, consider the hash of a configuration file, whose contents are mostly ...

Only top voted, non community-wiki answers of a minimum length are eligible