I'm working on a file encryption system where multiple versions of the same file might exist. The filenames are encrypted using AES in CBC mode with a random IV and stored in metadata. Since versions of the same file share the same filename, this information may be used by an adversary. Is there any additional information to be derived from multiple ciphertexts which are known to share the same plaintext, just with a different IV?
$\begingroup$
$\endgroup$
3
-
1$\begingroup$ I'm assuming they are all encrypted with the same key? So you have the same plaintext, encrypted with the same key, but a random IV each time. The attacker knows that the ciphertexts all encrypt the same plaintext (but doesn't know what that plaintext is), using the same key, but a random IV and you are wondering if that gives the attacker any advantage in figuring out the plaintext or possibly the key. Is that your question? $\endgroup$– mikeazoMay 25, 2016 at 15:03
-
$\begingroup$ Somewhat related: crypto.stackexchange.com/questions/31365 $\endgroup$– BivMay 25, 2016 at 15:09
-
$\begingroup$ Yes, the key and plaintext is the same. The attacker knows this and the IVs used but doesn't know the plaintext. Is there anything to learn about the plaintext when multiple ciphertexts are available instead of only one? $\endgroup$– sebi707May 25, 2016 at 15:16
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
0
the key and plaintext is the same. The attacker knows this and the IVs used but doesn't know the plaintext. Is there anything to learn about the plaintext when multiple ciphertexts are available instead of only one?
No. Giving the attacker multiple encryptions of a single plaintext using a randomly chosen IV and a fixed key with AES-CBC does not leak any more information about the plaintext than does a single ciphertext.
In fact if the attacker didn't know whether or not they were the same plaintext (but had the same length), the attacker couldn't tell you whether or not they encrypted the same plaintext.
$\begingroup$
$\endgroup$
2
If you use a random IV each time you encrypt a file, the result will be different. $$\text{AES-CBC}(IV_1, Key, M) = C_1$$ $$\text{AES-CBC}(IV_2, Key, M) = C_2$$ you do not gain any pieces of informations by having $C_1$ and $C_2$. Even knowing that they share the same key and should they share the same length, an attacker can not even know whether or not they are the same file (identically byte to byte). This is the goal of the $IV$. Therefore he would not be able to find or exploit differences between plaintext with similarities.
Hence you are perfectly fine with your scheme. The only informations that could be leaked is the date of creation and the size of the content. But it is hard to fight against that.
-
$\begingroup$ "an attacker can not even know whether or not they are the same file" but an attacker can distinguish between two different lengths of plaintexts. So, in a simple case, there are 2 files, one with a long name, one with a short name. The attacker will be able to distinguish between encryptions of the long file name and encryptions of the short file name. $\endgroup$– mikeazoMay 25, 2016 at 15:11
-
$\begingroup$ Right I should be more precise and add the file length into account. thx. $\endgroup$– BivMay 25, 2016 at 15:23