1
$\begingroup$

I know that it is never suggested to use the same key or key/IV pair twice for a stream cipher or for a block cipher operating in CTR mode. Filesystem-level encryption reuses the same key for a file when it is edited.

Would it be an okay idea or a bad idea to use CTR mode for such encryption? Would it require changing the IV upon each edit and re-encrypting to make sure it is secure?

Improve this question
$\endgroup$
1
  • $\begingroup$ So, I wouldn't say that "it is never suggested" but rather that "it is catastrophic." $\endgroup$
    – Xander
    Mar 2, 2016 at 21:36

1 Answer 1

Reset to default
3
$\begingroup$

From your question I'll assume that you do not plan to use strong means of authentication along with CTR encryption. If you do, the first point is invalid.

  • Never ever use CTR mode alone. If you use CTR mode alone (i.e. without authentication) you allow attackers bit level precision for changing files. This can result in very undesirable decryptions where important data was changed because the attacker knew the format, the position and the previous content.
  • Never ever re-use a nonce + key pair. If you do re-use a {nonce, counter} and key pair, you allow an attacker to perform a ciphertext only attack (the worst sort of attack imaginable) and the complete security of the system should break down. Note further that re-using the same counter at any space-time combination suffices.
Improve this answer
$\endgroup$
1
  • 3
    $\begingroup$ Furthermore, cipher modes like XTS are practically purpose-built for filesystem encryption. $\endgroup$
    – Stephen Touset
    Mar 2, 2016 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.