I've been trying to design a simple archive format, that allows me to just bundle a bunch of encrypted files together.
The idea, I currently have is to embed not the encryption key but a truncated hash of the encryption key in the message.
I'm assuming that both the sender and receiver has already obtained the symmetric encryption key but I need a method of communication that allows me to identify the key and I have been considering simply sending a truncated secure hash of the key itself but I'm unsure whether this actually compromises the integrity of the cipher.
Specifically, I'm using SHA-1 and AES-128, I'm worried that this approach will effectively reduce the security to a matter of brute forcing all 128 bit keys that produce a SHA-1 collision and that this simply is trivial to do, in that it completely renders the AES cipher, useless.
While I truncate the SHA-1 hash, I still leak 16 bytes of the SHA-1 hash that corresponds to the symmetric key used. So there is ambiguity there but probably not enough.
I'd really like to be able to identity what encryption key was used to encrypt the message in a secure manner without having to introduce some sort of ID sequence or external bookkeeping but maybe I'm trying to solve the impossible here.
Any input on this matter is greatly appreciated.