Consider the scenario where you want a machine to be able to send daily encrypted backups to a storage server.
You'd prefer to not use simply a symmetric key for encryption, because if the machine was compromised then the symmetric key would enable the entire history of backups on the storage server to be decrypted.
Are the following two schemes equivalent?
In all schemes, the storage server only allows uploads, and not downloads or deletions. In all schemes, generate a permanent EC keypair (a,A)
(where a
is the private key and A
is the corresponding public key). Store only A
on the machine.
Scheme 1: Generate an ephemeral EC keypair (e, E)
for each backup. Encrypt the data using an authenticated cypher (such as AES256-GCM or ChaCha-Poly1305) using the symmetric key H(eA)
, where H()
produces uniformly distributed hashes (such as SHA2-256). The backup is decrypted using the symmetric key H(aE)
, and E
is stored along with the backup. Successful decryption proves that only a machine that knew A
could have created the backup. Backups would include timestamps, so it would be detected if the same observed backup was retransmitted by an attacker at a later date.
Scheme 2: In addition to the permanent encryption keypair (a,A)
, keep a permanent authentication keypair (b,B)
on the machine. Then, Scheme 2 is the same as Scheme 1 except that prior to transmission, the encrypted backup is signed with b
. On decryption, verify the signature first.
At first glance, it might seem that Scheme 2 is superior, because it prevents backups from being uploaded by an attacker that learns of the public key A
. However, the authentication private key b
is stored on the same machine, so both b
and A
are likely to be leaked together. There is no way I can see that anyone compromising the storage server could deduce the public key A
that was used on each occasion when sending each backup.
Therefore, scheme 2 does not look superior to me, other than if it is suspected that the machine is compromised, the signing keypair (b,B)
can be replaced without also having to replace the keypair (a,A)
.
Is this correct? Does use of the authentication keypair in scheme 2 have any other advantage? Does knowledge of A
effectively authenticate the backup just as well as if the backup was signed with b
?