I'm encrypting a file and I'm using an initialisation vector. Given that the IV doesn't need to be a secret, is it secure if I add it to the encrypted file's name?

  • $\begingroup$ Assuming, that you authenticate the file name as associated data it's perfectly fine. If not - this is a more difficult question. $\endgroup$
    – SEJPM
    Dec 17 '15 at 19:27
  • $\begingroup$ You mean check that the filename has the correct format? $\endgroup$ Dec 17 '15 at 19:38
  • $\begingroup$ No, I mean checking the IV value wasn't tampered (this issue isn't specific to the file name but maybe easier forgotten there). GCM takes care of that for you, most other modes require it to do it yourself. $\endgroup$
    – SEJPM
    Dec 17 '15 at 19:40
  • $\begingroup$ GCM sounds a little fancy for me. Surely there's nothing to stop someone from trying a random IV, wherever a valid one happens to be stored? $\endgroup$ Dec 17 '15 at 20:00
  • $\begingroup$ GCM isn't "fancy". It's just a mode of operation. If whatever library you're using doesn't support it, find one that does. In 2015, non-authenticated modes of operation are no longer considered acceptable. $\endgroup$ Dec 17 '15 at 23:18

Yes, you can store the IV any way you want. Putting it in the file name is no different from putting it in the file contents.

(Actually, there's nothing specific to cryptography here. You could take any file you want and decide to move, say, the first $n$ bytes of its content into the file name. It's all just data.)

That said, as SEJPM notes in the comments, to protect your data from tampering you really should use some form of authenticated encryption (either with a bespoke AE mode, or using the generic Encrypt-then-MAC construction), and you do need to include the IV in the authenticated data, no matter where it's stored.

The risk here is that, depending on the cipher mode used, tampering with the IV could allow an attacker to modify the plaintext in more or less predictable ways. Even if decrypting with the wrong IV just produces gibberish, an attacker may be able to combine this with other attacks to learn something about the plaintext, especially if your code leaks information about the "gibberish" on decryption failure. Using authenticated encryption protects you from this.

Also, a practical risk with storing data in the file name is that people are much more likely to rename files than to randomly tamper with their contents (especially if the contents just looks like random binary data). Thus, using the file name to store critical data like the IV could lead to an increased risk of accidental data loss or corruption.

  • $\begingroup$ Putting an IV inside a file is also a risk because you might lose the software that knows how to decrypt it, based on its format. $\endgroup$ Dec 17 '15 at 23:57
  • 1
    $\begingroup$ If you lose your decryption software, and don't have any documentation to let you rebuild it, you're kind of SOL anyway. $\endgroup$ Dec 17 '15 at 23:59
  • $\begingroup$ I'd back @IanWarburton on that. You could imagine a scenario where the filename has changed but not the content (e.g. hard-disk issue then recovery) $\endgroup$ Jan 18 '19 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.