3
$\begingroup$

Suppose I am building an encrypted document storage system. Suppose each user has a "user key": a symmetric key. Suppose each document is encrypted with a "document key". So, in order to give a user access to a document, we store a tuple of (user_id, document_id, encrypted_doc_key) where the encrypted document key is encrypted using the user key. In this case, is there an appreciable difference in encryption modes?

The plaintext would be 1-2 blocks long, and random. Every time data is encrypted or decrypted, the entire thing is needed, so the ability to decrypt arbitrary blocks is not necessary. Even ECB seems like it should be relatively secure here, but I'm thinking using something with a random IV would be a better option. Given that the data being decrypted (the wrapped keys) shouldn't be able to be modified by an attacker, I'm not as concerned about authentication.

Is there an existing protocol that does something like this?

$\endgroup$
1
1
$\begingroup$

You can use a key wrap scheme. Frankly, any authenticated encryption mode would probably be fine, but a key wrap scheme is designed for exactly this purpose: encrypting one key under another key. So, you might as well use one of the accepted key wrap schemes.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.