23 reputation
3
bio website
location
age
visits member for 2 years
seen Sep 30 at 20:23

Dec
28
awarded  Editor
Dec
28
revised Is there a tree hash form of MAC that can be used when encrypting data for storage on S3 using multipart upload?
added 1687 characters in body
Dec
21
comment Is there a tree hash form of MAC that can be used when encrypting data for storage on S3 using multipart upload?
Looks like it will work. Each part uploaded (except last) will need to be a multiple of 128 bits, and I will need the part number. This should allow me to compute the CTR block (assuming that the IV and some other details are stored somewhere). Still figuring out the GHASH details. Will update this post once I have a working prototype.
Dec
21
awarded  Scholar
Dec
21
accepted Is there a tree hash form of MAC that can be used when encrypting data for storage on S3 using multipart upload?
Dec
20
comment Is there a tree hash form of MAC that can be used when encrypting data for storage on S3 using multipart upload?
@CodesInChaos, I want to be able to validate each part as it comes in, and reject the part if found to be corrupt. Once all parts are in place I want to combine the individual MACs to produce a MAC for the entire file. When the uploads are complete only the whole file MAC will be needed as we don't currently have a need for verifying chunks of a file as it is downloaded.
Dec
20
comment Is there a tree hash form of MAC that can be used when encrypting data for storage on S3 using multipart upload?
Thanks, this also seems to be what this paper is saying: mindspring.com/~dmcgrew/gmac-incr-c-00.pdf. I'll read the spec again and try to figure it out.
Dec
19
comment Is there a tree hash form of MAC that can be used when encrypting data for storage on S3 using multipart upload?
This is about the data being secure at rest and not readable by Amazon staff, or readable by others if an incorrect ACL allows the file to be downloaded. The encryption keys are stored on our systems and not accessible by clients, so encrypting the file in its entirety before client sends to us is not an option. The parts that the client sends can arrive at any of a number of production servers, so encrypting the entire file server side is not an option either. So as I receive each file chunk I need to encrypt and store it, and I got stuck on how to handle the MAC.
Dec
19
awarded  Student
Dec
19
asked Is there a tree hash form of MAC that can be used when encrypting data for storage on S3 using multipart upload?