AES-CTR-256 Sub Keys With Encrypted Sub Key Index

Question

I was working with some encryption and I decided to put a spin. To preface this would be used to encrypt multiple files.

You start with a key file generated from random data. For example you could generate a 288 byte key file. This file contains 9 sub-keys each 256-bits.

For each file to encrypt you securely randomly select a sub-key from the file. Then you create the header by append 28 bytes of random garbage bytes onto 4 bytes which is the index of the sub-key in the key file. You then use the first sub-key to encrypt this 32 byte header block.

The remainder of the file is encrypted using the sub-key and is placed after the header.

I was wondering if there are any obvious flaws to this approach. My nuonce is going to start at zero.

Would it also be even better to start the nouce using the first byte of the key?

Answer 1

I would advise a different solution.

You either generate a master-key (or key set) or derive one from a user password (e.g. via PBKDF2 or SCrypt). For each file to encrypt you generate a random key (file key) and nonce ad-hoc, and encrypt the file with that key, using an AEAD scheme.

The random file key is encrypted with you master key and put at the beginning of the file. Preferable you should include that encrypted key as authenticated data within the AEAD scheme.

The steps:

1. Generate random file key and nonce
2. Encrypt file key with master key (using a key-wrap spec.)
3. Encrypt the plaintext file data with the file key and using it enc. form as part of the authenticated data (AEAD scheme)
4. Store nonce, enc. file key and encrypted data as the enc. file

Your solution is dangerous. Using the same nonce with the same key (you only have 9 or so) to encrypt different data will allow an attacker to retrieve information concerning the plaintext data.