3
$\begingroup$

I understand that encrypting files in CTR mode is not perfectly safe, because it potentially leaves the files open for cryptanalysis, if the attacker has access to previous versions of the same files. But is this really feasible when we are talking about encrypting files?

Lets say we got a program that reads and writes encrypted files with AES CTR mode. If we have a word document it will be written to many times, and therefore change alot without the key and counter changing for specific blocks.

Now how feasible is it really for an attacker to actually find these previous versions on a given harddisk? Should this constellation not be reasonable secure against anyone except maybe the NSA?

Improve this question
$\endgroup$
3
  • $\begingroup$ Citation needed... if you are reusing nonces in CTR mode you're not doing it right (and ditto if you're using CTR to encrypt hard drives) $\endgroup$
    – Thomas
    Commented Aug 19, 2015 at 10:57
  • $\begingroup$ Reused kev/iv pairs amount to a many-time-pad. For many kinds of data, such as txt or html files this leaks a lot of information seeing 2 versions and nearly perfect recovery seeing 3 versions. We have several questions about that, just search a bit. $\endgroup$
    – CodesInChaos
    Commented Aug 19, 2015 at 11:57
  • $\begingroup$ The reason why nobody uses plain CTR for disk encryption is that bit flips propagate into the plaintext. If you flip a bit of the ciphertext the same bit of the plaintext gets flipped, allowing you fine-grained control about many things. F.ex. assume you have a file saying: "give bob 1000€", then if you know this is standing there you can easily flip bits and change it to "give bob 0001€". You'd be able to do this with all information. CBC and other modes prevent this to some extent. $\endgroup$
    – SEJPM
    Commented Aug 19, 2015 at 12:09

1 Answer 1

Reset to default
4
$\begingroup$

There's nothing wrong with using CTR mode to encrypt files, or anything else, as long as you make sure to use every nonce value only once. (And add authentication, if malleability would be a problem.) You could, for example, rewrite the whole file encrypting it with a new random nonce every time it's modified.

Since you are assuming nonce reuse, an attack that used different versions of the file would indeed be simple. How feasible it is depends on how easy those previous versions are to get to, which depends on what sort of threats you envision. An attacker who does see multiple versions does not need NSA-level powers.

Example attacks:

  • An attacker who can read the encrypted file e.g. daily would be able to just wait until you modify it.
  • If there are backups or a versioning filesystem, an attacker could find previous versions there.
  • Access to the raw HDD image might make an attacker able to read previous versions from currently unused parts of the filesystem.

Etc. None of these is really that difficult, if the attacker has proper access.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.