I'm symmetrically encrypting a file (using a random salt and a user supplied password with PKCS5S2, i.e., nothing special) and I need to be able to access it randomly. Therefore I'm using a stream cipher. This works well, but it allows the attacker to verify a wrong password when reading only a tiny part of the file (garbled data are easy to recognize).

IIRC there's an encryption schema making it impossible to read any part of the data in isolation, you must read it all (I forgot how it's called). This seems to conflict with my random access requirement, however I always need to read the whole file first and then I need the random access.

Is there an encryption schema allowing this, i.e.,

  • to obtain any information, all data must be decrypted first
  • afterwards, any portion of the data can be decrypted in isolation
  • 1
    $\begingroup$ You're thinking of an all-or-nothing transform, but something like that fundamentally won't work with random access. $\endgroup$ Oct 21, 2014 at 21:49
  • 4
    $\begingroup$ I wouldn't bother. Just focus on using a good password based KDF (such as scrypt). That way an attacker can verify the file with only a few bytes but they still incur the cost of the KDF for each password. $\endgroup$ Oct 22, 2014 at 7:44

1 Answer 1


Yes, you can do that. Start by generating a random key and encrypting the data under that key. Now, you in turn encrypt that key with your password-derived key. The twist is that you include the already encrypted file in your PBKDF. So you generate a random key $k$ and then encapsulate it as $\mathcal{E}_{k'}(k)$, where $k' = H(PBKDF(\text{password}) \| \mathcal{E}_k(\text{file})$. That way, to decrypt you have to read and hash the entire encrypted file to obtain the wrapper key, which gives you the key to decrypt the file itself. Once you have that key you can do random access, but for each password attempt you have to read and hash the whole file again.

  • $\begingroup$ That doesn't seem to have the properties that he's asking for. $\endgroup$ Oct 22, 2014 at 5:58
  • $\begingroup$ @StephenTouset As far as I can tell it does. You first need to commit to a password and then process the whole file to learn the actual key and thus any information about the file. $\endgroup$ Oct 22, 2014 at 7:42
  • $\begingroup$ @otus It's key dependent processing of the whole file. Since the intention of the OP is to only allow checking if the password is valid after processing the whole file, this should suffice. $\endgroup$ Oct 22, 2014 at 9:52
  • 1
    $\begingroup$ @Travis you forgot to salt the password hash. $\endgroup$ Oct 22, 2014 at 9:53
  • $\begingroup$ @CodesInChaos, if that's the intention, then sure, but the first bullet point in the question does say "all data must be decrypted first". $\endgroup$
    – otus
    Oct 22, 2014 at 10:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.