was frustrated by which one to pick and my brain could not guess which one is better Authenticate the whole file as one with a hash vs authenticating each ciphered text.

So very quickly: i have super large files of many GB, these cannot be encrypted at once with AES-Rijndael-CBC, so i split these large files into smaller chunks that the computer memory can handle and fully encrypt each of these chunks one at a time and append the finished encrypted cipher text and their IV's next to each other. And i want to make sure no manipulation can happen to these ciphered chunks...

So my current setup is this for every plaintext that is encrypted the output looks like this:

first chunk    = [SHA256(PASSWORD + IV + CIPHERTEXT) + IV + CipherText]...
Second chunk   = [SHA256(PASSWORD + IV + CIPHERTEXT) + IV + CipherText]...
Hundreth chunk = [SHA256(PASSWORD + IV + CIPHERTEXT) + IV + CipherText]...

This way i can check if any manipulation has been done before decrypting the chunk by calculating the hash value with my own password...

But then it hit me... instead of doing authenticating each ciphertext chunk why not take the whole file and calculate the hash of it + password?

so it would be something like this instead:

First Chunk     = [IV + CIPHERTEXT]...
Second Chunk    = [IV + CIPHERTEXT]...
Hundredth Chunk = [IV + CIPHERTEXT]...

Am i maybe getting myself into a pitfall here or does this keep the same good tamper protection?

EDIT: "password" has been derived with PBKDF2 in both showcases.

  • 1
    $\begingroup$ Could you stop for a while and define your actual problem instead of asking multiple questions. I've already mentioned you that stop using CBC and provided a good way with GCM that provides you confidentiality, integrity, and authenticity all together. $\endgroup$
    – kelalaka
    Commented Dec 28, 2019 at 11:10
  • $\begingroup$ You can do either one, lookup Merkle tree. But using a password instead of a symmetric key is a common pitfall. Read the PKCS#5 standards and understand PBKDF2 before continuing. $\endgroup$
    – Maarten Bodewes
    Commented Dec 28, 2019 at 13:57
  • $\begingroup$ @Maarten-reinstateMonica Fantastic :) Sorry i missed including that the "password" in this case was already derived with pbkdf2... I will edit the question. But then that's perfect and will save alot of space avoiding creating thousands of "authentication" hashes :) $\endgroup$
    – CoffeDev
    Commented Dec 28, 2019 at 14:49
  • $\begingroup$ Note that you can use a Merkle tree or list without storing the intermediate hash values at the nodes and only store the topmost node. That way you can still hash each block separately, if you still decide to go with blocks. That would also make it easier to switch to GCM with a final HMAC over all the authentication tags, because those are the kind of algorithms that should be preferable. SHA-256 is actually prone to length extension attacks and should not be used directly on a key + ciphertext. $\endgroup$
    – Maarten Bodewes
    Commented Dec 28, 2019 at 15:23
  • 1
    $\begingroup$ Just to avoid further edits: there is no such thing as AES-Rijndael. AES is a standardized subset of Rijndael cipher; therefore, if it is AES, then Rijndael is automatically assumed. $\endgroup$
    – Maarten Bodewes
    Commented Dec 28, 2019 at 22:29


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.