Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I have encrypted files stored on a public cloud, in the same directory on the cloud I have the sha256 hash of the files before they were encrypted in a text file.
The keys used to encrypt the files are stored locally. Is it plausible that someone after downloading the files could use the original hashes to help brute force the encryption?
I am thinking that it would provide no advantage but I just wanted to check.
It depends on the contents of your files. If the contents has high entropy and is unpredictable then you're probably safe.
However, if the contents is a password or a pin number, then brute forcing it should be trivial, it is for this reason that we use slow hashing.
Another scenario might be if the contents had a value which was commonly known (ie, a pirated movie). If the hash of that file is common knowledge, then so is the contents of your encrypted file.
To err on the side of caution, it's probably better to ensure the integrity of your file with a HMAC or Authenticated Encryption. You might want to read this thread.
In worst case, follow by collision problem, an adversary can find a $FILE$ that $sha256(FILE)=sha256(yourfile)$, and this leakage has not any useful information for improving bruteforce attack
