Linked Questions

3 votes
1 answer
224 views

Key Encryption: Does it need to be Authenticated?

Alice wants to store files $m_i$ on Bob's untrusted cloud storage platform, with the additional restriction that she can only store one master key $k$ herself. She encrypts the files with keys $k_i$ ...
8 votes
3 answers
3k views

What should the nonce value be for client-side encryption?

I am using the following chacha20poly1305 Rust library to encrypt some data in a desktop application. The user provides the key, which never leaves their device, to locally encrypt some data, and then ...
1 vote
1 answer
982 views

Salt value in scrypt algorithm

I see there are a lot of questions relating to handling of a salt value but nothing I have seen so far has cleared the following question. When using a KDF such a scrypt, I believe the value of the ...
0 votes
1 answer
298 views

XChaCha20 With a Zeroed Nonce?

We know that for ChaCha20 and XChaCha20, the same key can never be used with the same nonce. But let's say I use a random 256-bit key every time... Then the nonce can be whatever because the key is ...
1 vote
0 answers
41 views

How safe is store nonce with encrypted text? [duplicate]

I am using AESGCM256 with a nonce of 96 bytes to store keys (very secret information). There are more than 500 keys, the only place where they can be stored in ...
7 votes
1 answer
3k views

Multiple AES Key Derivation from a master key

I need cryptography advice regarding this issue. Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
1 vote
0 answers
373 views

E2E Encryption w/ PBKDF2 + AES-GCM

I'm currently developing a product that requires user data to be encrypted on the client side. The product is a web app + a browser extension, so the focus is encrypting user data with Javascript. The ...
0 votes
1 answer
292 views

Deterministic Encryption - Generating IV from password key

I need to encrypt file and directory names/paths but I need the encryption to be deterministic. I need to sync the local files with a cloud storage provider so I can't use probabilistic encryption. ...
1 vote
3 answers
3k views

What's the preferable encryption for large data and files in terms of speed and security other than AES?

First of all, I'm relatively new to encryption so please bear with me. I'm looking for a way to encrypt large amounts of data only on my device, no need to transfer my encrypted files/data (10-20GB or ...
2 votes
1 answer
453 views

How to encrypt many files with AES-GCM, without running the key derivation function each time?

Linked question: AES encrypting multiple files With a password, I have 100k files to encrypt. (Maybe 100k files today; or maybe 50k today, 10k tomorrow, and 40k ...
8 votes
2 answers
2k views

AES encrypting multiple files

So if I want to encrypt all the files in a folder with AES (same password) I take each file and generate the key schedule using PBKDF2. As the PBKDF2 algorithm takes in a salt then this salt should ...
2 votes
1 answer
7k views

AES-GCM cipher - Nonce vs IV

I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers: https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html As you see, IV is not ...
3 votes
2 answers
2k views

How to defend AES against chosen-plaintext attack?

I have a server which encrypts files with the same AES key. Users can upload a file and download its encrypted version. A user can upload as many files as he wants. Users can decrypt the documents via ...
3 votes
1 answer
1k views

File encryption with AES CTR mode

I understand that encrypting files in CTR mode is not perfectly safe, because it potentially leaves the files open for cryptanalysis, if the attacker has access to previous versions of the same files. ...