Let's say you need to encrypt
plaintext which is 1 TB big.
You have a password
pwd. This very classical AES-GCM process is applied (pseudo code):
salt = 16 random bytes key = PBKDF2(pwd, salt, count=1000*1000) # key derivation function nonce = 16 random bytes ciphertext, tag = AES_GCM_cipher(key, nonce).encrypt(plaintext) # by blocks in reality save to disk: salt | nonce | ciphertext | tag
Now if I suspect
pwd to be compromised, and I want to change it to
pwd_new, I have to restart the whole encryption process which might be long for 1 TB of data.
Question: which simple encryption scheme can I use, still using AES-GCM for the actual data, such that I can change the password without having to reencrypt/rewrite all the data?
(There are implementations of this for example in Microsoft BitLocker disk encryption, etc.)