I have some data that I CTR-AES-256 encrypt already. I am aware of ways to validate the integrity of the entire file (ie: a separate MAC of the plaintext, or encrypt then MAC, etc). But none of these apply to ranges.

For example: I put a 5TB movie up into a server. It's something crazy like 30 days of camera footage "footage1.mp4", that happens to be floating around on the internet. Being that this file is so huge, an attacker that can't decrypt the file could simply guess that any other file of the same length must be this file. So, attacker xors together footage1 with footage2, and xors it with the encrypted footage. This file is so big, that I only watch it in my browser - which will range request out of it. Heck... the attacker only overwrites the 100th Gb of the file to remove himself from the footage. Since I never get the entire file, I won't be able to check the hash of it.

  • Is it possible to have this kind of integrity check with CTR mode? (The range request is why the mode was chosen)
  • Does GCM handle integrity checks on a subset of all the blocks? (I didn't know anything at all about Galois Counter Mode when I started, and am not sure if this is what GCM might exist to address.)
  • 1
    $\begingroup$ "Is it possible to have this kind of integrity check with CTR mode?" ​ Yes; one can use a MAC tree. $\hspace{.53 in}$ $\endgroup$ – user991 Jul 8 '16 at 0:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.