I'm new to encryption and cryptography, I was wondering if there is a good or best suited AES mode for file encryption (Planning on zipping a folder and encrypt it as a file). If there is, how complex is it and is it easy to implement on python (preferred language)? Thank you.
$\begingroup$
$\endgroup$
3
-
$\begingroup$ Yes my plan is to zip a folder and encrypt it as a file. Sorry for any confusion $\endgroup$– user63579Jan 10, 2019 at 15:23
-
1$\begingroup$ If you have no prior knowledge or experience with cryptography, then you should use cryptography.io and their Fernet construction rather than cobbling together your own. $\endgroup$– Ella RoseJan 10, 2019 at 16:00
-
$\begingroup$ Just for curiosities sake, how large are the files you intend to encrypt? Are they small enough to fit in your available RAM? $\endgroup$– Ella RoseJan 10, 2019 at 19:49
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
12
Since you zip the directory before encryption, we can assume that the compressed directory now is random file. You can use CBC mode or CTR mode. However, these modes are not providing any authentication.
You should use authenticated encryption mode as AES-GCM.
There is another issue waits for you. How do you derive cryptographic keys from the user's password? The common method is using a KDF function as PBKDF2 or Argon2.
You generate a random AES key and encrypt the zip file with it. After the encryption, encrypt the AES key with the key derived from the user's passwords with KDF and store it together with the encrypted file.
For the random bytes generation, at least, you should use urandom.
Python has AES-GCM and PBKDF2. You can find the example codes as here and here
answered Jan 10, 2019 at 15:40
-
1$\begingroup$ Is there a reason you recommend pycryptodome? I find
PyCryptodome is not a wrapper to a separate C library like OpenSSL. To the largest possible extent, algorithms are implemented in pure Python.to be a bad thing, rather than a good thing... $\endgroup$ Jan 10, 2019 at 16:20 -
-
$\begingroup$ How about salt and base64? I havent got that deep into those topics. Do I need it here? Or it is vital to every encryption? $\endgroup$ Jan 10, 2019 at 23:44
-
-
$\begingroup$ Why should one use authenticated encryption? Isn't an attacker able to use an adjusted AES-GCM algorithm which does no authenticity-check? $\endgroup$– tipaSep 3 at 15:36
$\begingroup$
$\endgroup$
3
I prefer AES GCM because GCM is an authenticated encryption mode (in contrast to CBC or CTR which are not). However, the one significant limitation with GCM is don't encrypt more than 64 GB of data with a single key/IV pair.
Authenticated encryption does not mean that you can tell that a specific person encrypted the file, but it does mean that you can determine if the file has been corrupted (accidentally or intentionally). This is something that most other encryption modes do not provide. You can add this functionality by implementing some sort of MAC (e.g. HMAC), but that's extra work for you.
-
2$\begingroup$ GMAC / AEAD / MAC do offer message authentication; checking the authentication tag allows you to establish that the encrypted message was generated by someone that had access to the key, after all (unlike, e.g. public key encryption). What it doesn't offer is entity authentication: you cannot establish which identity performed the encryption - unless there was just one possible entity that held the secret key, of course. $\endgroup$– Maarten Bodewes ♦Jan 10, 2019 at 17:18
-
$\begingroup$ Im actually planning to go for GCM. But for the issue you mentioned, what can I do about it? Do I add another algorithm or change a mode? $\endgroup$ Jan 10, 2019 at 23:46
-
$\begingroup$ The easiest thing to do is to use the same key and switch IVs are regular intervals, e.g. 32 GB. You can even just increment IVs, with GCM it's ok that the IV be predictable, just that it not be reused. $\endgroup$ Jan 11, 2019 at 18:26