Assuming that you are paranoid before storing your file (distributed across a shared location), which will be the best case scenario: splitting the file first and then encrypting or encrypting first and then splitting?
$\begingroup$
$\endgroup$
4
-
2$\begingroup$ Better in what way? Time, space or security (which) considerations? The overhead would likely be higher (IV and padding, but both can be removed with clever use of previous chunks and proper slice positions) when encrypting every chunk separately. $\endgroup$– Artjom B.Oct 25, 2015 at 16:52
-
1$\begingroup$ @ArtjomB. Better from a security perspective (in terms of I/O) $\endgroup$– Runcy OommenOct 25, 2015 at 17:38
-
$\begingroup$ If your also compressing it, doing that at the time of splitting (before encrypting) would be best $\endgroup$– user2813274Oct 26, 2015 at 2:14
-
$\begingroup$ If security is your main concern, the best way would be to replace splitting with secret sharing. $\endgroup$– tyloJul 19, 2016 at 12:05
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
0
Either could be implemented securely, but if you encrypt first and split afterwards, you can use standard tools and get everything right more easily. If you used the opposite order, you would have several pitfalls to deal with:
- With password-based encryption you would either have to derive the key many times (spending resources that would be better used on additional hashing) or have a separate key derivation step and then use the key on all the parts.
- If you had a single key used multiple times, you would have to make sure IVs are unique, when with a single-use key you can forgo it completely.
- To fully authenticate the encrypted file you would need to add some metadata or a whole-file MAC, instead of simply using authenticated encryption on each part. Otherwise an attacker could be able to drop or reorder the parts.
- As a practical issue, if you are splitting to a certain target size, you would have to take into account the expansion caused by encryption IVs and authentication tags.
$\begingroup$
$\endgroup$
7
When doing backups to an online (cloud) provider, I split first, then encrypt. My files are all first tarred together, and the resulting file can end up being many GB in size.
If I try to encrypt that large tar file, it would take hours or days, and any problem will cause the encryption process to fail with no option to resume. By splitting first, I can encrypt each individual piece with the ability to resume the batch encryption process if it dies in the middle.
Another problem with encryption before splitting is that you must have all of the pieces to decrypt. If any get lost, the entire archive is gone as well. Contrasted with splitting first, you have a good chance at recovering most of the files even if one piece is lost, especially if they are tarred (one file after another with no compression).
-
1$\begingroup$ The entire archive is only lost if your splitting utility together with your encryption algorithm form a secure secret sharing scheme. It likely doesn't as A) They are separate pieces of software and B) it would be very inefficient for it to work as a secret sharing scheme if it usually isn't used for that. $\endgroup$– PyRulezOct 26, 2015 at 0:51
-
1$\begingroup$ @PyRulez, while it would likely be possible to decrypt even if some parts go missing, tools might not support that so you would be on your own. Also, if the first part is lost it may be impossible – if it contains a salt for password hashing, say. $\endgroup$– otusOct 26, 2015 at 5:27
-
1$\begingroup$ I'd note that the requirement to have all pieces available before you can decrypt any of them could be a good thing, depending on the application. (I think so, anyway, though I couldn't rule out a deeply reasoned argument that this is actually bad security in all cases.) $\endgroup$– David ZOct 26, 2015 at 7:34
-
$\begingroup$ @otus Well, most of rest will be horribly mangled. It would probably take a research team to recover anything. Just wanted to make sure people didn't try using it as a secret sharing scheme. $\endgroup$– PyRulezOct 26, 2015 at 8:44
-
$\begingroup$ @PyRulez depends on the cipher and mode used, but if splitting was block-aligned then e.g. CBC mode would mangle at most one block per part. $\endgroup$– otusOct 26, 2015 at 8:52