29 votes

How to check a file was encrypted (really & correctly)

If you can't get access to the key for at least some sample uses, there's no way to be sure. For example, it's impossible to distinguish AES-128 from AES-256 if you don't have access to the key. That'...
Gilles 'SO- stop being evil''s user avatar
19 votes

Is the decompression of compressed and encrypted data without decryption also theoretically impossible?

The decompression of compressed-then-encrypted data is not possible without the decryption key, at least for compression and encryption schemes independent of each other. We can make a theoretical ...
fgrieu's user avatar
  • 141k
16 votes
Accepted

Does exposing algorithm, key size and IV weaken the security?

No cryptography worth its salt should become less secure because its inner workings are known. It is usually assumed that the adversary has all that information when doing security proofs (Kerchoff's ...
Adrian's user avatar
  • 196
11 votes
Accepted

What are best practices for long term storage (~20 years) of encrypted / sensitive files?

There's simply no way to know. I find it very unlikely that AES will be vulnerable to a ciphertext-only attack in the next 20 years (remember, it has been around for over 20 years already and attacks ...
forest's user avatar
  • 15.3k
10 votes

How to check a file was encrypted (really & correctly)

Unless the file has a plaintext header which indicates that it has been encrypted, there is no way to distinguish ciphertext from uniform random data. You can heuristically guess that a file is ...
forest's user avatar
  • 15.3k
9 votes
Accepted

What is a safe maximum message size limit when encrypting files to disk with AES-GCM before the need to re-generate the key or NONCE

Security analysis of AES-GCM for maximum key use Note: I am not a cryptographer. As such there are probably mistakes in my analysis. Please help me fix my mistakes and built on top of this answer so ...
Stan Ivanov's user avatar
9 votes

Is the decompression of compressed and encrypted data without decryption also theoretically impossible?

You say you want to decompress the data coming from A so B can do incremental backups and recovery. Were A's data not encrypted this would make perfect sense. But A's data is encrypted and that ...
Schwern's user avatar
  • 461
8 votes

How to check a file was encrypted (really & correctly)

In addition to what the other answers have stated, "proper" encryption using AES-256 (block mode choice aside) can still allow backdoors, such as by maliciously choosing IVs/nonces. Phil Rogaway and ...
rlee827's user avatar
  • 234
8 votes

How does gpg know what cipher algorithm is needed for decryption?

how does gpg know which cipher is needed (in this case AES256 instead of the default CAST5? The OpenPGP Symmetric-Key Encrypted ...
Squeamish Ossifrage's user avatar
8 votes

File Size Shrinks After Encryption

PGP4Win (by default) does compression before encrypting. Many photos are extremely compressible, and so that compression shrinks the size a lot - rather more than the encryption overhead, resulting ...
poncho's user avatar
  • 147k
7 votes

Is the decompression of compressed and encrypted data without decryption also theoretically impossible?

I think it is theoretically possible to have semantically secure encryption that supports decompression of encrypted data (both in lossy and lossless compression settings), but that it will be very ...
Polytropos's user avatar
6 votes
Accepted

Best way to generate a IV for AES-CBC when encrypting files?

Generate a random IV (with a cryptographically secure random generator of course) and prepend the IV to the ciphertext. Some modes of encryption don't require a random IV, but you can never go wrong ...
Gilles 'SO- stop being evil''s user avatar
6 votes
Accepted

AES-CTR security if S-boxes substituion is omitted?

An Sbox is a necessary condition for the security of the AES or a similar block cipher but may not be sufficient. We can list all AES operations on a high level as SubBytes – a non-linear ...
kelalaka's user avatar
  • 48.5k
6 votes

Why does symmetric encryption not provide authentication and integrity? Is it only this type of encryption or cryptology in general have this issue?

Confidentiality vs authenticity Encryption aims at transmitting a secret message, maintaining it's confidentiality. It does not necessarily provide integrity or authenticity. That it to say, even with ...
fgrieu's user avatar
  • 141k
5 votes

Non-malleable file encryption using AES XTS 256?

As Paŭlo Ebermann notes in a comment above, the time cost of a proper MAC calculation is almost certainly negligible compared to the cost of reading or writing the data on the disk. Applying a MAC to ...
Ilmari Karonen's user avatar
5 votes

Best way to generate a IV for AES-CBC when encrypting files?

With AES-CBC you usually need a random IV. However, in the case where you use each key only once, like when using password-based encryption with random salts for each file, you can use a fixed, zero ...
otus's user avatar
  • 32.1k
5 votes

Does exposing algorithm, key size and IV weaken the security?

This is a touchy subject for cryptographers. The party line is "you should be able to reveal everything except the keys without decreasing the security of your system." If you assume this party line,...
Cort Ammon's user avatar
  • 3,261
5 votes
Accepted

Encrypt a big file in blocks with AES-GCM: how many nonce do we need?

AES-GCM can encrypt up to $2^{39}-256$ bits with a single key+nonce pair. That's just under 64GiB. A 10GiB file is fine. If you'd go beyond 64GiB you'll lose security. In that case, either use ...
SAI Peregrinus's user avatar
5 votes
Accepted

Is there any way to measure entropy of encryption algorithms in python?

Ciphers are deterministic. As such there is no such thing as "ciphertext entropy". Given a certain key, IV, and plaintext you should always get the same ciphertext. If neither of those ...
Maarten Bodewes's user avatar
  • 92.6k
4 votes

Does exposing algorithm, key size and IV weaken the security?

Ciphers are already designed to provide a sufficient security margin against attackers who know those details, as other answers make amply clear. But another way of looking at this question is: if ...
Luis Casillas's user avatar
4 votes

Does exposing algorithm, key size and IV weaken the security?

The cryptography systems have been designed in such a way that if their plain-text space, key space, key generation algorithm, encryption algorithm, decryption algorithm, cipher-text space are known, ...
Sahil Babbar's user avatar
4 votes

Non-malleable file encryption using AES XTS 256?

This appears to be a better question to offer this answer to, in addition to Seth's great answer to the question: "What is the advantage of XTS over CBC mode (with diffuser)?". Non-malleable file ...
Rob's user avatar
  • 290
4 votes
Accepted

In GnuPG, what's the difference between --s2k-cipher-algo and --cipher-algo?

(1,2) You could use: gpg2 --s2k-mode 3 --s2k-count 65011712 --s2k-digest-algo SHA512 --s2k-cipher-algo AES256 --symmetric /*file path* According to The GNU ...
Patriot's user avatar
  • 3,132
4 votes

How to check a file was encrypted (really & correctly)

This question is very easy to answer: The implementation isn't correct and you absolutely should not use it. Any other attitude towards this black box is hopelessly attackable. Your stance should be:...
Daniel Wagner's user avatar
4 votes

Proper way of encrypting large files with AES-256-GCM

No, the way that it is described, the solution is insecure. The chunks themselves are of course secure. That is: as long as you verify the authentication tag and if the IV is indeed unique, i.e. a ...
Maarten Bodewes's user avatar
  • 92.6k
4 votes
Accepted

How do I safely encrypt a file for transport and storage?

I'm however not very sure about how I would go about generating a suitable key from a password. Is using a simple hash function like SHA-256 secure? No, you'd generally use a Password Based Key ...
Maarten Bodewes's user avatar
  • 92.6k
4 votes
Accepted

Why use ASCII armor for file encryption?

"Surely most channels allow for transmitting binary data nowadays?" Sure, but PGP is ancient. A lot of things including email and Usenet are text based. And even though FTP can of course ...
Maarten Bodewes's user avatar
  • 92.6k
4 votes

Encrypt multiple chunks of data with an AEAD

This is a good question that should be answered more frequently in documentation. Does that mean that I can't read and encrypt the file in chunks, I have to load the whole file into memory and there'...
samuel-lucas6's user avatar
3 votes

Dangers of using CTR mode for encryption

From your question I'll assume that you do not plan to use strong means of authentication along with CTR encryption. If you do, the first point is invalid. Never ever use CTR mode alone. If you use ...
SEJPM's user avatar
  • 46k
3 votes
Accepted

(How) Can we use HOTP for file encryption?

I had only a quick read through the source, and I am not particularly fluent in C#, so I may have gotten something wrong. That said the process appears to be: Generate a random encryption key, ...
otus's user avatar
  • 32.1k

Only top scored, non community-wiki answers of a minimum length are eligible