Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So, let's say I have a theoretical service. User has some text they want to encrypt. They pass it to me, and I encrypt it. Then, only I should be able to decrypt it afterwards. Another kicker, it must use a common key. The key can change occasionally, but not be user-specific or anything like that.

What can I do to avoid people analyzing the encrypted results of known text to find the key? I know there are things like Length Extension Attacks. What encryption algorithm would be safest?

share|improve this question
    
Length-extension attacks apply to hash functions, not encryption algorithms. Standard encryption algorithms (such as CBC) are secure against chosen-plaintext attacks, so in fact they are explicitly designed to be secure in this type of scenario---the ability to encrypt plaintexts of his choosing does not give an attacker information on other ciphertexts. That being said, you should probably provide some more details on what your service is doing and what your threat model is. Crypto.stackexchange.com is probably a better place to ask this question. –  Seth Feb 25 '13 at 4:49
    
@Seth make that into an answer and I'll accept it. I just know you can't be too careful when dealing with security –  Earlz Feb 25 '13 at 7:00
    
Don't forget to use authenticated encryption, not plain CBC. –  CodesInChaos Feb 25 '13 at 16:46
add comment

2 Answers

First, length-extension attacks apply to hash functions, not encryption algorithms. You don't need to worry about them here.

To answer your question, standard encryption algorithms (such as CBC) are secure against chosen-plaintext attacks, so in fact they are explicitly designed to be secure in this type of scenario---the ability to encrypt plaintexts of his choosing under an unknown key does not give an attacker useful information about that key (or about other ciphertexts).

If there is any possibility that an attacker can tamper with the ciphertexts (for example, you're sending them through an unauthenticated channel or storing them in untrusted storage), then you should follow the advice of CodesinChaos and also look into using authenticated encryption. Look up GCM or HMAC.

You said you'd be willing to accept this answer if I moved it from a comment, but I'd encourage you to take a close look at AJ Henderson's answer, too. The unusual requirements of this vaguely defined theoretical service leave me feeling a bit wary of making specific recommendations, but if his suggestion is practical, it's probably the way to go.

share|improve this answer
add comment

If an encryption algorithm is susceptible to known plain text attacks, then it is fairly severely broken. Is there a reason that you don't use a public/private key encryption scheme? Then the user could actually encrypt it prior to transmission and you would still be the only one who could decrypt it. More ideally, you'd really want to have them choose a key, encrypt the data (symmetrically) with the key, encrypt the key with your public key, send the encrypted data and encrypted key to you, then if you need to use a common key, you could decrypt the data and re-encrypt it with your own key. This would give you protection while the file is in transit. (Alternatly, if it is a web service, simply using SSL for the transfer will do the same thing.)

Is there a particular reason you need to use the same key for every user? This is a big point of insecurity as it results in a single point of failure.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.