Basic question about design of program with data encryption

Question

I need to store encrypted files on a hard disk. The actual code side is not important for me now (I plan to use C# and AES-GCM encryption from Bouncy Castle library, please tell me if you think that's a bad idea!), but I'm having trouble designing the actual high-level algorithm.

How do I deal with user changing password (The key will be generated from password.)? Should I decrypt all the files encrypted with the old key and then encrypt them with the new one? Should I store the old password?

How to actually verify the password? An obvious answer that comes to my mind is "try to decrypt one of the files" but that doesn't seem right to me, because then there is no way to verify the password when encrypting the very first file. Sorry if these are dumb, but I'm completely new to cryptography.

Answer 1

How do I deal with user changing password (The key will be generated from password.)?

Generate a random master key K. Use K to encrypt the files. Use the user's password to generate a second key, K'. Encrypt the master key using K'. Then when the user changes his password, all you need to do is decrypt the master key using the old password and re-encrypt it using a new key derived from the new password.

How to actually verify the password?

If you encrypt the master key using AES-GCM, then decryption will fail if the password isn't correct. (Make sure that you take advantage of GCM's authentication feature; for Bouncy Castle specifics, see sections 3.3 and 3.4 of http://blog.philippheckel.com/2014/03/01/cipherinputstream-for-aead-modes-is-broken-in-jdk7-gcm/#Example-AES-GCM-with-three-CipherInputStream-implementations.) This would not be the case if you used, e.g., AES-CTR or AES-CBC.

I would strongly encourage you to look pre-existing solutions to encrypting file systems or volumes. There's lots of ways to screw up a design or implementation, and this is the safest (and probably easiest) solution. (But kudos to you for choosing a mode like GCM, that protects both the privacy and integrity of the data.)