1
$\begingroup$

I am encrypting files using AES/CBC/PKCSPadding, with 256 bits long keys. So far the first 16 bytes of each encrypted file are the IV.

I would like to store some more information regarding the algorithm used, key length, mode and padding at least.

This will be useful I think for two reasons:

a) I can scan the filesystem looking for my files and checking they are all encrypted (encryption is a new feature, so there are already a bunch of unencrypted files out there). This way I can create a background task that progressively encrypts all old files

b) Say someone breaks AES or there's a problem with CBC or something in 10 years or whatever. I could just upgrade the parameters of the encryption function and again scan the file system and upgrade the encryption of my files.

I was thinking for this something like:

byte[] header = "AES|256|CBC|PKCS5Padding|".getBytes(UTF_8);
byte[] iv = ...; // the result of cipher.getIV() after initializing the Cipher;

And then writing both the header + IV to the beginning of the file.

So my question is: Does adding such metadata to encrypted files create any security concerns for such files? Is this something that people normally do? If so, is the way I'm trying to do it (adding a fixed number of bytes) will be enough to accomplish this task?

$\endgroup$
  • $\begingroup$ I'm not providing a formal answer since I don't have the ability to completely answer "is this something that people normally do" w/r/t standards or conventions for file storage. However, this is not a security concern. A central principle of cryptography is that the security of algorithms and protocols do not need to and should not depend on any hidden information as to their descriptions and functions. $\endgroup$ – sju Nov 14 '14 at 6:52
  • $\begingroup$ I see. Understand your point and was under that same impression, but wanted to validate it. Thanks $\endgroup$ – alejo Nov 14 '14 at 7:50
2
$\begingroup$

This is pretty common. The method of encryption is public information, so it is safe to leave in the clear.

In your post you made no mention of authentication. This is something you absolutely must use, otherwise you have no way of knowing if your data has been modified and leaves you open to many attacks.

Consider using HMAC with SHA-256, or a block cipher mode with built-in authentication (e.g. GCM). Everything needs to be authenticated (any metadata, header, IV, ciphertext, etc).

$\endgroup$
  • $\begingroup$ Thanks. I didn't mention authentication, you are right, forgot about it. That information will be there in the header too $\endgroup$ – alejo Nov 14 '14 at 7:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.