End-to-end photo storage

Question

I've been tasked with developing an app that will need to store photos a user takes securely, and I've been struggling to think up a method to do this.

What I was thinking so far is as follows:

• When user first logs into the application, input their password along with a salt (stored in a database) to a key-derivation function to generate a hash
• Use this hash to encrypt an AES key
• Store this on a database

This way, when a user logs into the app, they can request the encrypted AES key and decrypt it by producing the same hash produced from their password.

Using this AES key, they can encrypt photos before sending them to the server, and decrypt them upon receiving them back.

Is this a viable method? Is there a better way to do it?

Any help would be appreciated.

Answer 1

What I was thinking so far is as follows:

• When user first logs into app, input their password along with a salt (stored in a database) to a key-derivation function to generate a hash
• Use this hash to encrypt an AES key
• Store this on a database

Firstly, make sure that the user's password has good strength. In general, this is the weakest point even there are strong encryption methods. The usual advice is to tell/teach them to use dicewire method (see in xkcd 936). This will make the passwords have good strengths. If the user's password is weak then password cracking methods will break the encryption; John the Ripper password cracker or the Hashcat searches. It is ciphertext only attack, however, the file structure of the image files will help to determine the correct key.

You can use the password-based key derivation like PBKDF2, or, better use Argon2 as the winner of the password competition in 2015, to derive a key with a random 256-bit salt for each file. The random salt can be appended to the encrypted file. Prefer the Argon2 if possible. You can also use HKDF to derive the keys.

A crucial part of such an application is that the user can forget their passwords. In this case, all of the photos are lost. The user must that countermeasure for themselves, write somewhere, use keypass, etc. The other mechanism by your application depends on the environment of the application and the risks.

For the encryption method use AES256-GCM^* or better prefer ChaCha2-Poly1305 since it is easier to use than GCM. They are authenticated encryption methods that will provide you Confidentiality, Integrity, and Authentication. For those, you need to derive a IV/nonce and that can be randomly generated since you generate a new key for each file. And never ignore the tag mismatch error. If your application is an image processing application that stores the files on the cloud you need to be careful when you upload the modified file. If the key and the IV are the same then an observer can leak information from the differences.

If you don't want to use a new key for each file, then you need to be careful about the IV reuse. In this case, the nonce misuse resistant scheme SIV can be used with AES-GCM-SIV.

---

_{^* Although AES-128 is secure, prefer AES-256 against the multi target attacks}