1
$\begingroup$

What would be recommended way to make deterministic password based file encryption?

I can use SIV mode, but KDF (like Argon) takes salt for which I could use SIV tag, but I cannot make it because I need key first.

I could use hash of file contents as salt, but that would make it 3-pass. If I would use some other single pass authenticated mode with IV generated with KDF, it would be 2-pass. Is there a better way?

EDIT: I changed my question (HKDF to KDF). I actually meant KDF generally (I had something like Argon in mind, not HKDF).

$\endgroup$
6
  • $\begingroup$ Why not prepend the random salt to the encrypted file? $\endgroup$
    – kelalaka
    Jul 8, 2023 at 17:50
  • $\begingroup$ @kelalaka You cannot, if you don't have reliable random/unique source. $\endgroup$
    – LightBit
    Jul 8, 2023 at 18:24
  • 1
    $\begingroup$ It is not you cannot, it is I cannot since you don't have a random/unique source.... You should detail more about your constraints... $\endgroup$
    – kelalaka
    Jul 8, 2023 at 18:29
  • $\begingroup$ @kelalaka Constraint is it has to be determistic encryption. It is more theoretical question as fallback in case I have limited or unreliable environment. $\endgroup$
    – LightBit
    Jul 8, 2023 at 19:50
  • $\begingroup$ It seems more details on what is the goal and what has been tried is needed. HKDF supports fix salts and that is a secure KDF via indifferentiability. Also, care must be taken with how the salt is generated. A file depend salt means the attacker has potential control over the salt in a CPA setting. $\endgroup$ Jul 11, 2023 at 20:35

1 Answer 1

1
$\begingroup$

HKDF doesn't require a salt. It does make the HKDF stronger, but in principle you can just use it without salt (or, if you're not sure, with an unreliable salt).

The salt is mainly there required when password-based encryption is used to protect against rainbow tables and identifying identical passwords. However, in this case with SIV mode you'd only be able to reliably detect identical files encrypted with the same password. The main problem seems to be the password based encryption itself.


Personally I would try and use asymmetric cryptography for this: encrypt the file using a public key (hybrid cryptography, encrypting or deriving a random AES key for each file) and protect the private key using a password and a real random salt. Then you can store the well-protected private key somewhere next to the file (or, preferably, somewhere more secure). You'd also not have to perform the PBKDF for each file, once you have the private key in memory.

Beware that many asymmetric algorithms are not secure against a full fledged quantum computer. So you might want to have another look if you want to protect your files against adversaries in the long term.

It should also be noted that, given a public key, anybody is able to encrypt. That could be a problem as an adversary may, for instance, swap or insert ciphertext without having a key.


Note that, if you remove time from the equation, that the full path is usually unique for each file. So if you'd hash that you'd have a pretty good deterministic salt - which you could also mix with a non-reliable salt. You should probably still store the salt as not to make decryption rely on that full path.

$\endgroup$
3
  • $\begingroup$ I changed my question. I actually meant KDF generally (I had something like Argon in mind not HKDF), but I think it does not make any difference. $\endgroup$
    – LightBit
    Jul 12, 2023 at 10:08
  • $\begingroup$ Hmm, that's debatable. HKDF is a key based KDF (KBKDF) while Argon is a password based KDF (PBKDF). For HKDF a salt enhances security (and many KDF's don't accept a salt as explicit / separate input parameter), while for a PBKDF a salt is a necessary parameter. $\endgroup$
    – Maarten Bodewes
    Jul 12, 2023 at 13:47
  • $\begingroup$ Using some unreliable salt like some poor jitter or coarse timestamp or file path still seems reasonable protection against rainbow tables. Although I still kinda like idea of hashing file contents and using some single pass to encrypt, if files are small enough. $\endgroup$
    – LightBit
    Jul 21, 2023 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.