2
$\begingroup$

Using Java, I wrote a piece of code that encrypts a given file with AES in GCM mode of operation. So far nothing uncommon.

Now I would also like to encrypt the filename, in the following way:

encrypted filename <- AES(key, IV, original filename).

In order to avoid having multiple key:IV pairs, I also encrypt data with the same key and nonce, like so:

encrypted file <- AES(key, IV, original file)

I know that reusing a key:IV pair is strictly forbidden when dealing with stream ciphers, but since the filename and the file are both in the same set of data, my guess is that it should be fine. However, I am not sure.

Anyone can confirm this ?

tl;dr is it OK to encrypt both a file and the filename with the same key:IV pair with GCM ?

$\endgroup$
4
$\begingroup$

I would say thats not safe.

GCM works as CTR, so an attacker that knows (part of) the plaintext version of the file name can compute the beginning of the file as plaintext.

If you XOR the two encryption, you'll have the XOR of plaintext, and if you know the filename, you'll get the (beginning of the) file.

To securely encrypt the filename you'll need a different IV. There are some way to generate both IVs starting from a unique value, you could (for example) use a HKDF using to generate two IVs from a salt stored on the encrypted file metadata. I've stumbled on the cryptographical specification of gocryptfs. They use a different way, the encrypt the filename with AES-EME.

EME (ECB-Mix-ECB) is a wide-block encryption mode developed by Halevi and Rogaway in 2003 [eme]. (see references below)

EME uses multiple invocations of a block cipher to construct a new cipher of bigger block size (in multiples of 16 bytes, up to 2048 bytes).

Quoting from the original [eme] paper:

We describe a block-cipher mode of operation, EME, that turns an n-bit block cipher into a tweakable enciphering scheme that acts on strings of mn bits, where m ∈ [1..n]. The mode is parallelizable, but as serial-efficient as the non-parallelizable mode CMC [6]. EME can be used to solve the disk-sector encryption problem. The algorithm entails two layers of ECB encryption and a “lightweight mixing” in between. We prove EME secure, in the reduction-based sense of modern cryptography.

[eme] A Parallelizable Enciphering Mode Shai Halevi, Phillip Rogaway, 28 Jul 2003 https://eprint.iacr.org/2003/147.pdf Note: This is the original EME paper. EME is specified for an arbitrary number of block-cipher blocks. EME-32 is a concrete implementation of EME with a fixed length of 32 AES blocks.

$\endgroup$
  • $\begingroup$ Indeed, your reasoning works but only if the attacker knows the filename. Based on the length on the encrypted filename, it may be possible to guess some string and to perform bruteforce "xoring" based on that. I'm better off using a key:IV pair for the filename and another one for the actual file. $\endgroup$ – Dreadlockyx Apr 21 '16 at 12:30
  • $\begingroup$ You need to change only the iv. You could keep the same key. (or check the crypto specification of gocryptfs) $\endgroup$ – ddddavidee Apr 21 '16 at 12:36
  • $\begingroup$ You could derive the new IV from the old one (e.g. by hashing, using a KBKDF, ...) and still be safe, it only matters that they are different. That way, you would not have to save two different IVs. $\endgroup$ – malexmave Apr 21 '16 at 20:16
9
$\begingroup$

This is terrible. In GCM, if you use the same nonce, then the authenticator is completely broken (for all messages in the future). You should never assume that the attacker doesn't know the filename either. You MUST use different IVs.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.