I have a problem where an encrypted file stored on a server needs to be decrypted through a precomputed list of passwords that are used one time only - OTP applied to encryption basically. The file is in a secure state while active and decrypted, it cannot be modified or publicly seen. While it is at rest, it is publicly viewable and modifiable, so I can't store a list of passwords on the server, as the server is often not in a secure state, and the file needs to be transferred often in a very public manner where it will be almost definitely be seen. After discussing this with a friend, something based on Diffie-Hellman was suggested. My question is how secure it might be.
The idea is to generate a list of hashes, and store only the list of
g^H_n along with the encrypted file. The file is encrypted each time by taking a hash,
g^H_n, a random working value
r and encrypting the file with the key
g^r is stored in the file publicly. In order to decrypt, the user provides
H_n which can be used to calculate
(g^r)^H_n and decrypt the file. Re-encrypting is then simply doing the same thing with
g^H_(n-1) taken from the list, and a new random working value.
If at any point the file is obtained by someone publicly (such as when the file is at rest), they will only know
g^r, which cannot be used to compute the key. Apart from the last hash used to encrypt, all the other hashes are encrypted along with the file, so future keys cannot be tampered with either.
This seems like it would work pretty well, but I'm nervous about doing something like this without knowing how easily it could be broken, and I cannot find any existing methods for doing the same thing. I'm hoping someone could point out any major flaws in this that might've been overlooked.