2
$\begingroup$

I have large files which are broken into blocks of 512 KB and uploaded to a server. In my DB I store the IV, and the user knows the security key themselves. When downloading, I use the same IV and key.

However, is it insecure running AES-CBC on each different block with the same IV? Won't this give away information -- e.g. 1 512 block encrypted will equal the next 512 block if they are both identical? And if I can't load the entire file into memory at once, is the only safe way to do it storing many IV's? (100 GB file would have 200k IV's...)

Improve this question
$\endgroup$
1
  • $\begingroup$ The XTS mode was pretty much made for exactly this purpose. You should strongly consider using it instead of CBC, which is not a good fit for your problem. $\endgroup$
    – Stephen Touset
    Jan 17, 2014 at 18:50

2 Answers 2

Reset to default
3
$\begingroup$

It is insecure to reuse the $IV$ with AES-CBC. At the very least, if the files have a common prefix, this will be revealed as a common prefix of the ciphertexts. For AES-CBC, the only way to ensure confidentiality is to use random $IV$s.

However, if you are not restricted to a particular CBC mode, the nonce-based Counter mode (CTR) might solve your problem. Each block is then encrypted with unique number (nonce) $N$ instead of $IV$. It does not have to be secret, moreover, it can be predictable (for example, it can be the block index).

Another option is to try modes of operation dedicated to small-block encryption. XTS, which employs key-dependent tweaks instead of IVs and nonces, is a widely used example.

Improve this answer
$\endgroup$
2
  • $\begingroup$ This is what I effectively was going to do -- I was going to store my IV, and write something that iterates a change to the IV on each consecutive block. (like IV + 1, but not that simple). CTR sounds similar in idea $\endgroup$
    – Paul
    Jan 17, 2014 at 8:32
  • 3
    $\begingroup$ IV+1 is insecure in the CBC mode. $\endgroup$
    – Dmitry Khovratovich
    Jan 17, 2014 at 13:46
1
$\begingroup$

Dmitry Khovratovich has a very good answer, like usual.

Using same IV multiple times in AES-CBC is not secure, please don't do it.

I would also recommend to prefer CTR mode, but also provide you a few more useful instructions, which may aid you.

If you use CBC mode and make random IVs, it is possible to make single random IV per file if you encrypt the file entirely in one go.

CBC mode reading is parallelizable, i.e. it is possible to read a part of the file from middle and convert it to plaintext without reading preceding part.

CTR mode, on the other hand allows to do both reading and writing, part at once.

However, in both CBC and CTR mode, new counter/IV (or new key) needs to be used when rewriting a block.

BTW, 200k IVs is around 3.2 megabytes. Although that is quite large amount of bytes, it is very small compared to 100GB of storage required by the entire file.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.