1
$\begingroup$

I am new to cryptography and have been experimenting with AES to encrypt files. I was testing some code I found online which allows the user to enter the directory of the files that they went to encrypt/decrypt, the program then asks for the user to input the “password” or “key” to be used for the encryption/decryption.

My problem is that I accidently inputted the wrong password/key when I was trying to decrypt the file, and as I hadn’t added a way for the program to detect incorrect passwords it tried to decrypt the file and so I was left with a file that was still in an encrypted/corrupted state.

I am wondering if it is possible to recover the original encrypted file. I now know the correct password that I should have first used to decrypt the file as well as the incorrect password that was used.

I have found another page where a user had a similar problem here Repair AES-128 decrypted file however this user did not specify that they knew the “correct” password that would have worked for the decryption, whereas I do.

The encryption function used in the script used a random IV as well as AES mode CBC.

Any help appreciated thanks

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

Note: This is answer version 2. I hastily answered the question incorrectly before.

It's not possible without brute forcing the IV. While encryption is reversible, encryption is generally one-to-many operation and decryption a many-to-one operation. This is because using the same key pair IV accross multiple messages can compromise security. For example if you send the same message twice then a one-to-one deterministic algorithm would leak the fact that you said the same thing twice. The part of the IV in any encryption algorithm that cannot be reused is called a "nonce" for number-used-only-once.

One way to generate distinct nonce values is to start with zero and increment by one every time you encrypt. If at some point you forget the counter you have to rekey. You could recover data in this case.

A random nonce is a memoryless way to prevent reuse. It needs to have enough entropy to prevent the same random value being generated twice. (Large enough to prevent birthday collisions.) This means a random IV is too long to brute force if you lose it.

However if you knew the IV and key, you could reverse CBC encryption. If it's deleted and unpredictable you cannot. CBC mode is deterministic and invertible for a given/known key/IV pair. It has the property $E_{K,IV}^{-1}(E_{K,IV}(M))$ = M (normal operation). Where $E$ is encryption and $E^{-1}$ is decryption. Additionally $E_{K,IV}(E_{K,IV}^{-1}(M)) = M$. It's not something you would normally do, but you could do it to recover the ciphertext file.

I assume you encrypted plaintext, deleted the original file, then wrote the ciphertext to disk. Then in the decryption process you encrypted with the wrong key, deleted the ciphertext (that included your IV), then wrote the wrong plaintext to disk. That process would mean you lost the IV because the random IV is only stored in the ciphertext file.

When you use encryption you should also use message authentication. You check if the MAC tag attached to a message is correct before trying to use decrypted data. Using authentication would have prevented your mistake.

Improve this answer
$\endgroup$
3
  • 1
    $\begingroup$ Continuing where the answer stops: the IV was lost. In CBC encryption a change in IV (similar to a change in plaintext) propagates all over the ciphertext. Thus if we we re-encipher as suggested, the presumably wrong IV we'll use will propagate and we'll get rubbish. Partially known original plaintext (header..) would not help, because the random IV used in the initial encryption has propagated all over. The answer's strategy will work only if we can somewhat recover the IV. But we have no info on how the code the OP found online generates the IV. $\endgroup$
    – fgrieu ♦
    May 11, 2018 at 17:23
  • $\begingroup$ @fgrieu Thanks for the great addition to version 1 of my answer. I had to go somewhere without WiFi and wrote a new answer while offline. I'm not sure if I should have left the original answer, put both in the edit, or left the old one alone. Does version 2 look better? It feels too verbose $\endgroup$
    – Future Security
    May 11, 2018 at 17:26
  • $\begingroup$ My answers tend to be verbose too.. My only critic is that there might be ways to find the IV better than by brute force given the "some code I found online" fragment of the question. $\endgroup$
    – fgrieu ♦
    May 11, 2018 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.