0
$\begingroup$

Regular scenario

Let's say I have secret files which I will encrypt. The resulting container will be shared and might be intercepted. Not good, but that's okay - that's why I encrypted the data in the first place.

Scenario in question

However, now, I'll encrypt and share the same data again. With the same passphrase. The container will be different (because the key changed) but the data inside it is identical. And the attacker knows this. Does this open the encryption to any vulnerabilities from a cryptographical standpoint?

Pardon my lack of technical terms. I guess this would be a ciphertext-only attack? But modified in a way that each plaintext (my data, my files) prior to encryption is the same?

(It's a general question, the encrypted container might be from dm-crypt/LUKS or VeraCrypt or even an encrypted ZIP archive. But I think all of them are using 256-bit AES.)

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ Cross-posted on security and already has an answer there. And, better suites there. $\endgroup$
    – kelalaka
    Commented Dec 1, 2018 at 21:00
  • $\begingroup$ If the keys are not related then an attacker could simply encrypt himself and make the ciphertext insecure. That would be weird, no? If the keys are related then knowledge of one key could lead to knowledge on another key, and security could be breached. $\endgroup$
    – Maarten Bodewes ♦
    Commented Dec 1, 2018 at 22:08

1 Answer 1

Reset to default
3
$\begingroup$

...but the data inside it is identical. And the attacker knows this. Does this open the encryption to any vulnerabilities from a cryptographical standpoint?

No. If it did, then encryption would not be very useful.

In fact, modern encryption schemes are designed to be secure even if:

  • The adversary already knows the plaintext that the ciphertext represents (known plaintext attack - KPA)
    • Where "secure" means they cannot recover the key or learn any information from other ciphertexts
  • The adversary can choose plaintexts, submit them to be encrypted, and obtain the resultant ciphertexts (chosen plaintext attack - CPA)
  • The adversary can choose ciphertexts, submit them to be decrypted, and obtain the resultant plaintexts (chosen ciphertext attack - CCA)

Even in all of these scenarios, a modern cipher will remain secure. Not only will it protect the plaintext from discovery, no adversary will even be able to distinguish a ciphertext from a random stream of bits with a non-negligible probability.

As long as the encryption provider is:

  • using a competent algorithm (such as AES-256 mentioned in the question)
  • in an appropriate mode of operation (e.g. an authenicated mode such as GCM)(edit: AEAD is apparently not relevant in this scenario)
  • and handles initialization vectors appropriately

then the messages will remain as secure as the passphrase that protects them. How secure the passphrase is will depend on how long/complex it is, combined with how the key is derived from it.

Improve this answer
$\endgroup$
5
  • $\begingroup$ Containers like the ones OP described usually use XTS, not GCM or any AEAD. $\endgroup$
    – forest
    Commented Dec 2, 2018 at 7:25
  • $\begingroup$ Thank you for the detailed answer. When you say "No. If it did, then encryption would not be very useful." do you mean that in a practical or theoretical way? Because I read that a vulnerability is defined as anything which makes the cracking better than brute-force. And a KPA on AES seems to reduce the time - admittedly while still not being a viable attack. Do I understand that right? It seemed to me like your answer says that AES isn't vulnerable to KPA, CPA or CCA at all. $\endgroup$
    – finefoot
    Commented Dec 2, 2018 at 12:15
  • $\begingroup$ @Jayjayyy Both - Can you cite a paper that uses known plaintext attack on full AES to reduce the cost of breaking it to lower than $2^{128}$? (It must be in an applicable attack model - the related key attack model is not relevant to encryption). Most papers attack reduced round versions of the cipher. The only successful attack on the full cipher I know of is the Biclique attack; But if I recall correctly, that only improves the time cost of breaking AES by 1 or 2 bits or so, while the total cost (time*area product) is worse than a generic attack. $\endgroup$
    – Ella Rose
    Commented Dec 2, 2018 at 17:28
  • $\begingroup$ en.wikipedia.org/wiki/Biclique_attack I just read a little bit about it. This is fascinating. Thanks again. :-) $\endgroup$
    – finefoot
    Commented Dec 2, 2018 at 19:17
  • $\begingroup$ What about something like this: If it's not safe to store a container on Dropbox because of XTS, wouldn't the same attack be applicable for multiple containers? Is it because it's multiple containers of the same content vs multiple versions of one container? $\endgroup$
    – finefoot
    Commented Jun 12, 2019 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.