GCM: use the same key:IV pair to encrypt file and filename

Question

Using Java, I wrote a piece of code that encrypts a given file with AES in GCM mode of operation. So far nothing uncommon.

Now I would also like to encrypt the filename, in the following way:

encrypted filename <- AES(key, IV, original filename).

In order to avoid having multiple key:IV pairs, I also encrypt data with the same key and nonce, like so:

encrypted file <- AES(key, IV, original file)

I know that reusing a key:IV pair is strictly forbidden when dealing with stream ciphers, but since the filename and the file are both in the same set of data, my guess is that it should be fine. However, I am not sure.

Anyone can confirm this ?

tl;dr is it OK to encrypt both a file and the filename with the same key:IV pair with GCM ?

Answer 1

I would say thats not safe.

GCM works as CTR, so an attacker that knows (part of) the plaintext version of the file name can compute the beginning of the file as plaintext.

If you XOR the two encryption, you'll have the XOR of plaintext, and if you know the filename, you'll get the (beginning of the) file.

To securely encrypt the filename you'll need a different IV. There are some way to generate both IVs starting from a unique value, you could (for example) use a HKDF using to generate two IVs from a salt stored on the encrypted file metadata. I've stumbled on the cryptographical specification of gocryptfs. They use a different way, the encrypt the filename with AES-EME.

EME (ECB-Mix-ECB) is a wide-block encryption mode developed by Halevi and Rogaway in 2003 [eme]. (see references below)

EME uses multiple invocations of a block cipher to construct a new cipher of bigger block size (in multiples of 16 bytes, up to 2048 bytes).

Quoting from the original [eme] paper:

We describe a block-cipher mode of operation, EME, that turns an n-bit block cipher into a tweakable enciphering scheme that acts on strings of mn bits, where m ∈ [1..n]. The mode is parallelizable, but as serial-efficient as the non-parallelizable mode CMC [6]. EME can be used to solve the disk-sector encryption problem. The algorithm entails two layers of ECB encryption and a “lightweight mixing” in between. We prove EME secure, in the reduction-based sense of modern cryptography.

[eme] A Parallelizable Enciphering Mode Shai Halevi, Phillip Rogaway, 28 Jul 2003 https://eprint.iacr.org/2003/147.pdf Note: This is the original EME paper. EME is specified for an arbitrary number of block-cipher blocks. EME-32 is a concrete implementation of EME with a fixed length of 32 AES blocks.

Answer 2

This is terrible. In GCM, if you use the same nonce, then the authenticator is completely broken (for all messages in the future). You should never assume that the attacker doesn't know the filename either. You MUST use different IVs.