Hot answers tagged

7

This is terrible. In GCM, if you use the same nonce, then the authenticator is completely broken (for all messages in the future). You should never assume that the attacker doesn't know the filename either. You MUST use different IVs.


4

Under the ideal cipher model, security is not diminished by any choice of value $H = E_K(d)$ for a known value $d$, as long as none of the counter values that get encrypted to generate the encryption stream is equal to $d$. This is what "ideal cipher" means: you have no information on $E_K(x)$ for any $x$ that you have not already tried to encrypt with the ...


2

I would say thats not safe. GCM works as CTR, so an attacker that knows (part of) the plaintext version of the file name can compute the beginning of the file as plaintext. If you XOR the two encryption, you'll have the XOR of plaintext, and if you know the filename, you'll get the (beginning of the) file. To securely encrypt the filename you'll need a ...



Only top voted, non community-wiki answers of a minimum length are eligible