29
votes
How to check a file was encrypted (really & correctly)
If you can't get access to the key for at least some sample uses, there's no way to be sure. For example, it's impossible to distinguish AES-128 from AES-256 if you don't have access to the key. That'...
19
votes
Is the decompression of compressed and encrypted data without decryption also theoretically impossible?
The decompression of compressed-then-encrypted data is not possible without the decryption key, at least for compression and encryption schemes independent of each other. We can make a theoretical ...
- 144k
16
votes
Accepted
Does exposing algorithm, key size and IV weaken the security?
No cryptography worth its salt should become less secure because its inner workings are known. It is usually assumed that the adversary has all that information when doing security proofs (Kerchoff's ...
- 196
11
votes
Accepted
What are best practices for long term storage (~20 years) of encrypted / sensitive files?
There's simply no way to know. I find it very unlikely that AES will be vulnerable to a ciphertext-only attack in the next 20 years (remember, it has been around for over 20 years already and attacks ...
- 15.4k
10
votes
How to check a file was encrypted (really & correctly)
Unless the file has a plaintext header which indicates that it has been encrypted, there is no way to distinguish ciphertext from uniform random data. You can heuristically guess that a file is ...
- 15.4k
9
votes
Accepted
What is a safe maximum message size limit when encrypting files to disk with AES-GCM before the need to re-generate the key or NONCE
Security analysis of AES-GCM for maximum key use
Note: I am not a cryptographer. As such there are probably mistakes in my analysis. Please help me fix my mistakes and built on top of this answer so ...
- 390
9
votes
Is the decompression of compressed and encrypted data without decryption also theoretically impossible?
You say you want to decompress the data coming from A so B can do incremental backups and recovery. Were A's data not encrypted this would make perfect sense. But A's data is encrypted and that ...
- 461
8
votes
How to check a file was encrypted (really & correctly)
In addition to what the other answers have stated, "proper" encryption using AES-256 (block mode choice aside) can still allow backdoors, such as by maliciously choosing IVs/nonces. Phil Rogaway and ...
- 234
8
votes
How does gpg know what cipher algorithm is needed for decryption?
how does gpg know which cipher is needed (in this case AES256 instead of the default CAST5?
The OpenPGP Symmetric-Key Encrypted ...
- 49.2k
8
votes
File Size Shrinks After Encryption
PGP4Win (by default) does compression before encrypting. Many photos are extremely compressible, and so that compression shrinks the size a lot - rather more than the encryption overhead, resulting ...
- 150k
7
votes
Is the decompression of compressed and encrypted data without decryption also theoretically impossible?
I think it is theoretically possible to have semantically secure encryption that supports decompression of encrypted data (both in lossy and lossless compression settings), but that it will be very ...
- 594
7
votes
Why does symmetric encryption not provide authentication and integrity? Is it only this type of encryption or cryptology in general have this issue?
Confidentiality vs authenticity
Encryption aims at transmitting a secret message, maintaining it's confidentiality. It does not necessarily provide integrity or authenticity. That it to say, even with ...
- 144k
6
votes
Accepted
Best way to generate a IV for AES-CBC when encrypting files?
Generate a random IV (with a cryptographically secure random generator of course) and prepend the IV to the ciphertext.
Some modes of encryption don't require a random IV, but you can never go wrong ...
6
votes
Accepted
AES-CTR security if S-boxes substituion is omitted?
An Sbox is a necessary condition for the security of the AES or a similar block cipher but may not be sufficient. We can list all AES operations on a high level as
SubBytes – a non-linear ...
- 49.3k
5
votes
Best way to generate a IV for AES-CBC when encrypting files?
With AES-CBC you usually need a random IV. However, in the case where you use each key only once, like when using password-based encryption with random salts for each file, you can use a fixed, zero ...
- 32.3k
5
votes
Non-malleable file encryption using AES XTS 256?
As Paŭlo Ebermann notes in a comment above, the time cost of a proper MAC calculation is almost certainly negligible compared to the cost of reading or writing the data on the disk.
Applying a MAC to ...
- 46.4k
5
votes
Does exposing algorithm, key size and IV weaken the security?
This is a touchy subject for cryptographers. The party line is "you should be able to reveal everything except the keys without decreasing the security of your system." If you assume this party line,...
- 3,271
5
votes
Accepted
Encrypt a big file in blocks with AES-GCM: how many nonce do we need?
AES-GCM can encrypt up to $2^{39}-256$ bits with a single key+nonce pair. That's just under 64GiB. A 10GiB file is fine.
If you'd go beyond 64GiB you'll lose security. In that case, either use ...
- 5,854
5
votes
Accepted
Is there any way to measure entropy of encryption algorithms in python?
Ciphers are deterministic. As such there is no such thing as "ciphertext entropy". Given a certain key, IV, and plaintext you should always get the same ciphertext. If neither of those ...
- 94k
4
votes
Does exposing algorithm, key size and IV weaken the security?
Ciphers are already designed to provide a sufficient security margin against attackers who know those details, as other answers make amply clear. But another way of looking at this question is: if ...
- 14.6k
4
votes
Does exposing algorithm, key size and IV weaken the security?
The cryptography systems have been designed in such a way that if their plain-text space, key space, key generation algorithm, encryption algorithm, decryption algorithm, cipher-text space are known, ...
- 141
4
votes
Non-malleable file encryption using AES XTS 256?
This appears to be a better question to offer this answer to, in addition to Seth's great answer to the question: "What is the advantage of XTS over CBC mode (with diffuser)?".
Non-malleable file ...
- 290
4
votes
Accepted
In GnuPG, what's the difference between --s2k-cipher-algo and --cipher-algo?
(1,2) You could use:
gpg2 --s2k-mode 3 --s2k-count 65011712 --s2k-digest-algo SHA512 --s2k-cipher-algo AES256 --symmetric /*file path*
According to The GNU ...
- 3,142
4
votes
How to check a file was encrypted (really & correctly)
This question is very easy to answer:
The implementation isn't correct and you absolutely should not use it. Any other attitude towards this black box is hopelessly attackable.
Your stance should be:...
- 216
4
votes
Proper way of encrypting large files with AES-256-GCM
No, the way that it is described, the solution is insecure.
The chunks themselves are of course secure. That is: as long as you verify the authentication tag and if the IV is indeed unique, i.e. a ...
- 94k
4
votes
Accepted
How do I safely encrypt a file for transport and storage?
I'm however not very sure about how I would go about generating a suitable key from a password. Is using a simple hash function like SHA-256 secure?
No, you'd generally use a Password Based Key ...
- 94k
4
votes
Accepted
Why use ASCII armor for file encryption?
"Surely most channels allow for transmitting binary data nowadays?" Sure, but PGP is ancient. A lot of things including email and Usenet are text based. And even though FTP can of course ...
- 94k
4
votes
Encrypt multiple chunks of data with an AEAD
This is a good question that should be answered more frequently in documentation.
Does that mean that I can't read and encrypt the file in chunks, I
have to load the whole file into memory and there'...
- 2,060
3
votes
How can we encrypt a file to be just readable (and not writable) after decryption?
A "file" is a convenient metaphor for a sequence of bits on a specific file system. Your copy of foo.bar is not the same as my copy of foo.bar, even if they contain the same data. And short of ...
- 163
3
votes
Reusing IV in AES for encrypting file
You aren't telling us exactly what you plan to do, but plenty enough that we can tell you: no, just no. The first mistake you're making is that you're talking about "files" in a way that's worrisome ...
- 14.6k
Only top scored, non community-wiki answers of a minimum length are eligible