Fernet is a supposedly idiot-proof, AES-based symmetric encryption scheme that was (again, supposedly) carefully designed to avoid any pitfalls that might compromise security.
I want to use the same key to encrypt multiple files, including modified versions of the same file.
I'm aware that many encryption schemes, especially home-brewn ones, become vulnerable to cryptoanalysis when keys are re-used (simplest example: XOR-based stream cipher), and I didn't find any explicit statement in the Fernet documentation that permits key reuse.
On the other hand,
- Fernet is supposedly idiot-proof
- Fernet uses a random IV each time it encrypts something
- The documentation doesn't warn about reusing keys
So, what can go wrong if I reuse a key with Fernet?
My alternative approach, if key reuse is unsafe, would be to encrypt the files as follows:
- Choose a random salt
- Use a KDF to calculate the individual key from shared key and salt
- Encrypt the file with the individual key, and append the salt
But this seems wrong (salt is only for use with passwords, not with random data...) and more importantly requires me to use low-level cryptography primitives which are explicitly not idiot-proof.