2
$\begingroup$

I'm new to encryption and cryptography, I was wondering if there is a good or best suited AES mode for file encryption (Planning on zipping a folder and encrypt it as a file). If there is, how complex is it and is it easy to implement on python (preferred language)? Thank you.

New contributor
user63579 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
$\endgroup$
  • $\begingroup$ Yes my plan is to zip a folder and encrypt it as a file. Sorry for any confusion $\endgroup$ – user63579 Jan 10 at 15:23
  • $\begingroup$ Okay thank you. $\endgroup$ – user63579 Jan 10 at 15:29
  • 1
    $\begingroup$ If you have no prior knowledge or experience with cryptography, then you should use cryptography.io and their Fernet construction rather than cobbling together your own. $\endgroup$ – Ella Rose Jan 10 at 16:00
  • $\begingroup$ Just for curiosities sake, how large are the files you intend to encrypt? Are they small enough to fit in your available RAM? $\endgroup$ – Ella Rose Jan 10 at 19:49
1
$\begingroup$

Since you zip the directory before encryption, we can assume that the compressed directory now is random file. You can use CBC mode or CTR mode. However, these modes are not providing any authentication.

You should use authenticated encryption mode as AES-GCM.

There is another issue waits for you. How do you derive cryptographic keys from the user's password? The common method is using a KDF function as PBKDF2 or Argon2.

You generate a random AES key and encrypt the zip file with it. After the encryption, encrypt the AES key with the key derived from the user's passwords with KDF and store it together with the encrypted file.

For the random bytes generation, at least, you should use urandom.

Python has AES-GCM and PBKDF2. You can find the example codes as here and here

$\endgroup$
  • 1
    $\begingroup$ Is there a reason you recommend pycryptodome? I find PyCryptodome is not a wrapper to a separate C library like OpenSSL. To the largest possible extent, algorithms are implemented in pure Python. to be a bad thing, rather than a good thing... $\endgroup$ – Ella Rose Jan 10 at 16:20
  • $\begingroup$ @EllaRose got it. $\endgroup$ – kelalaka Jan 10 at 16:41
  • $\begingroup$ How about salt and base64? I havent got that deep into those topics. Do I need it here? Or it is vital to every encryption? $\endgroup$ – user63579 Jan 10 at 23:44
  • $\begingroup$ Salt used to increase the entropy of the KDF, use urandom . Base64 is an encoding of the output. For the IV size of AES-GCM see. re-write since the link of base64 was missing. $\endgroup$ – kelalaka Jan 11 at 16:56
0
$\begingroup$

I prefer AES GCM because GCM is an authenticated encryption mode (in contrast to CBC or CTR which are not). However, the one significant limitation with GCM is don't encrypt more than 64 GB of data with a single key/IV pair.

Authenticated encryption does not mean that you can tell that a specific person encrypted the file, but it does mean that you can determine if the file has been corrupted (accidentally or intentionally). This is something that most other encryption modes do not provide. You can add this functionality by implementing some sort of MAC (e.g. HMAC), but that's extra work for you.

$\endgroup$
  • 2
    $\begingroup$ GMAC / AEAD / MAC do offer message authentication; checking the authentication tag allows you to establish that the encrypted message was generated by someone that had access to the key, after all (unlike, e.g. public key encryption). What it doesn't offer is entity authentication: you cannot establish which identity performed the encryption - unless there was just one possible entity that held the secret key, of course. $\endgroup$ – Maarten Bodewes Jan 10 at 17:18
  • $\begingroup$ Im actually planning to go for GCM. But for the issue you mentioned, what can I do about it? Do I add another algorithm or change a mode? $\endgroup$ – user63579 Jan 10 at 23:46
  • $\begingroup$ The easiest thing to do is to use the same key and switch IVs are regular intervals, e.g. 32 GB. You can even just increment IVs, with GCM it's ok that the IV be predictable, just that it not be reused. $\endgroup$ – Swashbuckler Jan 11 at 18:26

Your Answer

user63579 is a new contributor. Be nice, and check out our Code of Conduct.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.