I have read/write disk images encrypted with 128 AES using Mac's disk utility. If I snapshot the encrypted disk images daily (sometimes with changes other times without), and an attacker has access to these snapshots, will they be able to gain any parts of the plaintext? Will they be able to gain any metadata about the plaintext?
$\begingroup$
$\endgroup$
2
-
1$\begingroup$ In general we're not so much Apple experts here; most of us would identify as cryptographers or cryptography enthusiasts. So it would help immensely if you would indicate the OS version that you are using and the algorithm & mode of operation used for the disk encryption (which must be somewhere in the documentation about the disk utility). $\endgroup$– Maarten Bodewes - on strike ♦Jul 5, 2022 at 16:33
-
$\begingroup$ The OS version is Monterey 12.3.1, the algorithm and mode is XTS-AES-128. $\endgroup$– AlexanderWatkinsJul 5, 2022 at 17:43
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
4
Yes, snapshots of encrypted disk images weaken security. How much they do so depends on the exact algorithm, but it's impossible to have decent performance for disk encryption with perfect security if the adversary can make ciphertext snapshots: you'd have to reencrypt the whole disk all the time.
To have anywhere near decent performance, at a minimum, disk encryption doesn't re-encrypt data that hasn't changed. Therefore an adversary who obtains two ciphertext snapshots will know that certain parts of the data for sure haven't changed. Generally disk encryption has a granularity of sectors of a few hundred bytes to a few kilobytes. Figuring out what files have changed knowing what sectors have changed is typically hard, but it's not impossible.
To further improve performance (and secondarily storage density), disk encryption typically uses an algorithm with an implicit IV which is derived from the sector number. (If that isn't the case, the IV must be stored somewhere. So either the plaintext sectors are smaller than the disk sectors; or accessing a sector needs to access both the disk sector containing the ciphertext and the disk sector containing the IV.) Thus, when a sector is re-encrypted, the old ciphertext and the new ciphertext use the same key and IV, which reveals some information. How much information depends on the encryption mode.
With XTS, which is a popular choice, given two versions of the ciphertext of a sector, you can tell the length of the common prefix, up to the granularity of the block cipher block (i.e. 16 bytes for AES and all other block ciphers in current use). For example, if the old and new ciphertext start with 400 identical bytes, it means that the plaintext changed between the 400th and the 415th byte (and possibly more after that as well). (As encryption modes go, XTS is very robust in this respect — modes typically used for communication are a lot weaker, but they don't need to be strong since they use unique IVs.)
answered Jul 5, 2022 at 19:21
Gilles 'SO- stop being evil'Gilles 'SO- stop being evil'
18k4 gold badges45 silver badges88 bronze badges
-
$\begingroup$ If I understand correctly, there is no plaintext data leakage, and the metadata being leaked is the size of the data changes between snapshots (rounded to the nearest block cipher block size) and the size of the unchanged (prefix) amount. Is my understanding correct? $\endgroup$ Jul 5, 2022 at 20:48
-
1$\begingroup$ @AlexanderWatkins There is no direct data leakage. There can be indirect data leakage through oracle attacks. For example, an adversary who can secretly dump your backups guesses that a sector contains
My password is swordfish, then they fill your browser cache withMy password is a,My password is b, etc. in the hope that the same sector will be overwritten with a cache file, and they can tell if the first letter of the password matches. It's pretty difficult to arrange any useful data leakage, but it's possible in principle. $\endgroup$ Jul 5, 2022 at 20:59 -
$\begingroup$ What do you mean by "fill your browser cache" and "the same sector will be overwritten with a cache file"? If I had a file with the text "My password is swordfish" that lined up with a sector, an attacker wouldn't be able to continuously guess values as they can't create their own ciphertexts to compare with the previous snapshots because they don't have the encryption key. $\endgroup$ Jul 5, 2022 at 21:23
-
1$\begingroup$ @AlexanderWatkins The attacker injects plaintext, not ciphertext. For example by arranging for you to browse a web page (e.g. serving an ad) that gets written to the browser's cache. $\endgroup$ Jul 5, 2022 at 21:27