Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My scenario is this -- I want to store an encrypted container on a network server. This encrypted container should be accessible to others to download and decrypt/mount locally provided they have the key. If the container is ~64MB (random example size) and I mount it locally, add a file, and then unmount... Is there a way to upload only the changes to the encrypted volume (I'm assuming the md5/sha1 hash changes after you drop a new file into the container) to the server and change just those portions of the container, without having to re-upload the entire container each time?

share|improve this question
related: Applying file deltas to an encrypted file. – David Cary Sep 1 '14 at 18:22
up vote 1 down vote accepted

A close enough solution is Rsyncrypto.

Rsyncrypto is a utility to encrypt files in an rsync-friendly fashion. The rsyncrypto algorithm ensures that two almost identical files, when encrypted with rsyncrypto and the same key, will produce almost identical encrypted files. This allows for the low-overhead data transfer achieved by rsync while providing encryption for secure transfer and storage of sensitive data in a remote location.

Rsyncrypto is a modified encryption scheme. It is based on industry standard AES for symmetric encryption, as well as RSA for having different keys for each file while allowing a single key to decrypt all files. It even uses an encryption mode that is based on CBC.

share|improve this answer
This is exactly what I was looking for, I need to read up on it, but I had a few quick questions for you about it. 1. When using rsync to match the containers, what data specifically is being sent? Is it the bit changes to the container file? 2. What did you mean when you said almost identical encrypted files? The key will still work on it, but what changes? – RyanInBinary Jan 9 '13 at 20:54
1. In order to make the encrypted data "transport efficient", the container is sliced up into chunks and each chunk is encrypted separately. Modifications to one part of the container would trigger a modification to the corresponding chunk. The chunk is modified, encrypted and sync-ed to the other side. 2. A normal encryption scheme would produce two very distinct encrypted files from two slightly different files. This would require resyncing of the whole encrypted file. This method of slicing up and encrypting chunks would produce almost identical encrypted files BUT for the different chunk – Cristian Dobre Jan 9 '13 at 21:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.