0
$\begingroup$

I am encrypting some publicly known data, and some private data using the same key, using AES256 with CBC.

An attacker does not have the ability to choose what the public data is.

Is this safe? (It looks to be, according to: Why is AES resistant to known-plaintext attacks?)

Assume I encrypt 4096_zeros.plain (public data) and my_private_data.plain with the same key and iv, producing 4096_zeros.crypt and my_private_data.crypt.

Is it possible for an attacker to use 4096_zeros.crypt to speed up either:

  • the decryption of my_private_data.crypt, or
  • the recovery of the key and iv.

Is using (and storing) a different iv for each file sufficient? (Am I correct in thinking that I'd need to store the iv with the encrypted data?)

If not, would adding 32 random bytes to the start of each file (which would be ignored after decrypting) be sufficient?

$\endgroup$
  • 1
    $\begingroup$ Using a different IV for each file is the proper way to do it. $\endgroup$ – cygnusv Mar 9 '15 at 11:06
  • $\begingroup$ @cygnusv Am I correct in thinking that I need to store the (randomly generated) IV with each encrypted file, or there will be no way to decrypt the file? Is if OK for the IV to not be secret? $\endgroup$ – fadedbee Mar 9 '15 at 11:11
  • 1
    $\begingroup$ what mode operation are you using? $\endgroup$ – Vincent Mar 9 '15 at 13:13
  • $\begingroup$ @VincentAdvocaat CBC, but would/could change to something better $\endgroup$ – fadedbee Mar 9 '15 at 13:31
  • $\begingroup$ Nah CBC is probably the best for encrypting files, if you want the difference between mode operations check this and storing the CBC iv is no problem I would recommend you to use a different IV for each file though. $\endgroup$ – Vincent Mar 9 '15 at 13:55
1
$\begingroup$

Take a look at this article it explains the IV can be publicly known once you have encrypted your data.

Is using (and storing) a different iv for each file sufficient? (Am I correct in thinking that I'd need to store the iv with the encrypted data?)

Yes, as a matter of fact i would not recommend using an IV twice, just for safety.

Is this safe? (It looks to be, according to: Why is AES resistant to known-plaintext attacks?)

Yes, like the article says they would still have to bruteforce the key to get the cipher text

So there is no problem in doing this, though if data is public why would you encrypt it? everyone knows it, why go through all the trouble?

Use a MAC, to quote the page i linked to:

Altering the IV Before Decryption

If the adversary can alter the IV, without detection, before the ciphertext is decrypted, then they can corrupt the first block of plaintext. If the adversary knows the first block of plaintext is P and the original IV is OIV, and wants it to decrypt to Z, they can alter the IV to be P XOR Z XOR OIV, which will cause the first block to decrypt to Z (since (P XOR OIV) XOR (P XOR Z XOR OIV) = Z).

Encryption provides secrecy, not authentication or integrety. If encryption is used in a setting where the adversary can modify the IV or ciphertext, it must be authenticated. The right way to do this is to have the sending party apply a keyed Message Authentication Code (MAC), like HMAC, to the IV and ciphertext, and have the receiving party check that the MAC is correct before decrypting.

$\endgroup$
  • $\begingroup$ The "public" data is potentially derivable metadata. It being public is a worst case scenario, so I asked about that. I'm already encrypting then HMACing. $\endgroup$ – fadedbee Mar 9 '15 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.