I have the following draft to keep my data secure in transit.

  1. Generate 2048 bit RSA key
  2. sha256sum that private key and use that sum as aad, key and iv parameters in the following aes encryption function
 12 int aes_encrypt(unsigned char *plaintext, int plaintext_len, unsigned char *aad,
 13                 int aad_len, unsigned char *key, unsigned char *iv,
 14                 unsigned char *ciphertext, unsigned char *tag)
 15 {
 16     EVP_CIPHER_CTX *ctx = NULL;
 17     int len = 0, ciphertext_len = 0;
 18     if (!(ctx = EVP_CIPHER_CTX_new())) {
 19         handleErrors();
 20         return -1;
 21     }
 22     if (1 != EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL)) {
 23         handleErrors();
 24         return -1;
 25     }
 26     if (1 != EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, 16, NULL)) {
 27         handleErrors();
 28         return -1;
 29     }
 30     if (1 != EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv)) handleErrors();
 31     if (aad && aad_len > 0) {
 32         if (1 != EVP_EncryptUpdate(ctx, NULL, &len, aad, aad_len)) {
 33             handleErrors();
 34             return -1;
 35         }
 36     }
 37     if (plaintext) {
 38         if (1 != EVP_EncryptUpdate(ctx, ciphertext, &len, plaintext, plaintext_len)) {
 39             handleErrors();
 40             return -1;
 41         }
 42         ciphertext_len = len;
 43     }
 44     if (1 != EVP_EncryptFinal_ex(ctx, ciphertext + len, &len)) {
 45         handleErrors();
 46         return -1;
 47     }
 48     ciphertext_len += len;
 49     if (1 != EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, 16, tag)) {
 50         handleErrors();
 51         return -1;
 52     }
 53     EVP_CIPHER_CTX_free(ctx);
 54     return ciphertext_len;
 55 }

Is that even secure? Can one single sha256sum of private key be universally used for AES encrypting multiple files on different content?

  • 5
    $\begingroup$ How will this be decrypted? The recipient will need the RSA private key, so what's the point of using a RSA key? Also, the IV needs to be unique for each message sent. $\endgroup$
    – Conrado
    Aug 26 '19 at 14:28
  • $\begingroup$ yes, recipient has the original RSA private key $\endgroup$ Aug 27 '19 at 7:51

Is that even secure?

No, the security of this breaks horribly if it's used with more than one file or more than once with different revisions of the same file. In particular an adversary can learn the XOR of any pair of file (revisions) encrypted with this and can make arbitrary modifications to the files without the cryptographic mechanisms detecting it.

use that sum as aad, key and iv parameters in the following aes encryption function

The hash is meant to be your key, so only use it for that input. Reusing a key/iv pair with AES-GCM (as evident from the code) gives rise to the aforementioned security issues. So ideally the hash of the key is used as the key only and the nonce is randomly or statefully generated as to be unique for each file (revision). Also note that while in practice AES-GCM does hide the AAD input, this is not guaranteed by the security model in which it is proven secure which also admits schemes as secure which encode a copy of the AAD input as part of the ciphertext, which in this case would obviously leak the key.

Generate 2048 bit RSA key
sha256sum that private key

There is really no point to generating an RSA key here if all you do with it is perform some symmetric encryptions. A "cleaner" solution would be to just generate a 256-bit key directly and use that.

  • $\begingroup$ thanks for the answer, to summarize it: 1. use static key (key) + dynamic nonce (IV). What input should be used for aad then? $\endgroup$ Aug 27 '19 at 7:52
  • $\begingroup$ @kurthectic If you don't have any associated data that needs to be public it can be left empty. $\endgroup$
    – SEJPM
    Aug 27 '19 at 7:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.