I am serialising JSON objects, and would like to encrypt some of the values. I plan to do this with AES-GCM.
I would also like to ensure the integrity of the overall object.
The requirements are for integrity of the overall object, confidentiality for some of the values, plus a requirement for plaintext for other values.
There are a small number of known top-level keys.
For example, if my "plaintext" JSON object were
{ "id":"823623672", "address": { "line1": "2000 Broadway", "line2": "New York", "zip": "12345" }, "telephone": "+1 212 555 1234", "last-accessed": 1543946340 }
I would like an "encrypted" object to be something like
{ "id":"823623672", "address": "URAVvDTOrovXBehz2ms8ej9BRCaKdx8LsmuA81IkESM=", "telephone": "0gAtx7Hh/kPD7chfNGy90A==", "last-accessed": 1543946340 }
Now, I can easily serialise the address
and telephone
and encrypt them, and provide the values of id
and last-accessed
as the associated data.
However, the actual objects I will be using will have quite a bit more data in the "do not encrypt" keys.
So instead of using the values of id
and last-accessed
as the associated data directly, I would like to hash these values and use the hash as the associated data. (Probably SHA-512/256, if it matters.)
To decrypt, I will re-create the associated data (hash) from the input data, then decrypt each of the encrypted keys; if any of the decryptions fail then the overall decryption fails.
(And using the hash means I can create the associated data using hash "updates" with the values of the known keys one after the other, rather than having to create a single contiguous data item with the values all concatenated. In this instance I would be hashing 823623672 then '\0' then 1543946340 then '\0'; the separators are to ensure an attacker couldn't change the id
to "82362367" and the last-accessed
to 21543946340, for example.)
(I do not have to worry about an attacker adding additional top-level keys; the ones that have semantic importance will be in the associated data/hash.)
It seems to me that using the hash should not weaken the security of the encryption, but I'd like to check.
Is using a hash rather than the full data going to weaken the security of the encryption?