I am using an encryption program to encrypt my documents. Previously I have used PGP and AxCrypt, so I just wanted to see how this new tool encrypts the file.
This tool is keeping parameters like cipher name, key size,initialization vector etc. in plain text.
I want to know whether exposing these details can anyway help an attacker to focus his attacks.
Below are the top few lines of a sample encrypted file:
» ÌšÚ>Öùq¸ë®ûÑÅ#Ÿ £¦É² $Náøj_{
"artifact":"header",
"cipher":{
"algorithm":"AES",
"IvBytes":"c6+TSc609YSMQSeorKSwAg==",
"mac":{
"enabled":false
},
"mode":"CBC",
"padding":"PKCS7",
"keySize":256,
"blockSize":4096,
"iv":"c6+TSc609YSMQSeorKSwAg=="
},
"metadata":{
"name":{
"encrypted":false,
"value":"~$$tmpFDC6.tmp.bc"
}
},
"version":1,
"encryptedFileKeys":[{
"type":"data",
"id":"2705583903525488672",
"value":"KIgNTpyr1+9QLSUijmpxh0jnfyi/6fIY2zoBzMsw2/B3WDmbV3+M2QsLbCLei++G8UDsjyjFiooXQpWJbUF75+Sg2AhhHS4YkvytSrgUW3/J56ky+a0XDti46e0I94oHAstL/BrS31NIqkCQW80qCja4nEzkRyHE5j3W8SR9nh8I2oDSONesy/BenzIUjz3IoNnYD750LKR7IA7xrJ75hT9uYZ9oZr9EKcKPR0Fwyy1dnVCaJWrstjnAYunnKw8irU70zmYxh6ytDsc3x70e7aj7rikQ7n3H4CquOyPqvIESpuGGWzlrTAvNoT8UHJuegAxWEMewOVkAYuwEcUnOIQt5YV8/B8ds+hfyAGRD4rf7GjsCExC+t69ekeDB63+s7LcmkCsZJKpiER3D3+OpYaANQxs2ceIEPPEPOrVbL98eTJa42elL29CeIkA5rmYtMhv6Nh+baH5LxOWxTrKM4n+dlnSwsd//CupGC0jWi8JNCu9MEx0o33S1TgqEGjYRSBLh/rfQu7CaYB4JxaluuqfOstb33JESaX77b1jBadwj1t977ZGKw4HK3HMcrQoJL1yjEd71uHOOX5bgKrvz1V9hrxNkT6MseeSV7N9Vf38oYAZrSz0dGemQBNpxZMwhKu9qd6Xi6V8v5Az7CcYcaEtQCc+tO7F3Vgmfv92U5WQ="
}]
}
"mac":{"enabled":false}
; this implies that someone could modify the file, and you'd never know. There's a number of known ways for attackers to perform exploits (including attacks on privacy) without such protection, hence it's generally considered advisable to use a MAC (or some integrity check); presumably, the tool you're using has such an option (otherwise they wouldn't specifically say 'it's turned off' in the config) $\endgroup$