I'm planning on storing chunks of encrypted data inside a file, along with each chunk would be the hash(sha256) of the unencrypted chunk stored in the file as well. Is storing the hash secure?
1
-
7Secure against what? And why is it necessary in the first place?– AndrolGenhaldApr 25, 2018 at 21:38
Add a comment
|
3 Answers
Generally speaking, no, it is not as secure.
One specific security property you lose is that of indistinguishably. What indistinguishably gives you is the ability to prevent an attacker from determining when two ciphertexts are the same message, or different messages. In order to provide this, modern encryption methods generally provide a way for you to encrypt the same message twice, or any number of arbitrary times, and end up with completely unrelated ciphertexts each time.
If you also hash the plaintext, you lose this, as the hash value will always be identical for identical messages.
Depending on the specific application, there are other security issues you could run into, up to and including the potential for complete recoverability of the plaintext from the hash values alone, but the loss of indistingishability is a certain effect.
If the hashes are of the unencrypted data, then an attacker can check if the file's contents match a specific plaintext. ("Is this file an encrypted copy of pirated_song.mp3?")
Also, if the hashes are there so the file's contents can be checked for corruption, then the integrity-checker must decrypt the file to check it. If the hashes are of the ciphertext instead, then check the file's integrity without needing to know its key. This could be a useful ability to allow depending on the specifics of the situation.
If you are afraid of the hashes being reversed to their original plaintext data, this is simply not possible due to the one-way nature of hash functions, unless an attacker is able to brute force the contents of a chunk and end up with the same hash.
The only possible use of the hash that I see would be if the attacker already had the unencrypted chunk and wanted to determine which encrypted chunks held that data, but there isn't much purpose at that point.
answered Apr 25, 2018 at 22:09
-
@androlgenhald cryptographic hashes are specifically designed to prevent attackers from recovering the message from its hash without a bruteforce attack ("pre-image resistance"), among other things. So there's not much to hesitate about. Apr 26, 2018 at 8:12
-
2@A.Darwin And if the data is a phone number? FYI my comment was before the answer was edited to mention the possibility of brute force. Apr 26, 2018 at 12:41
-
@Androlgenhald that property holds for any possible message. What changes with the message content is the feasibility of a brute force/dictionary attack. If the data is a phone number, a brute force/dictionary attack operates on a space of 10^x elements, x being the length of the phone number. Typically x is around 10, so you could build a huge table and find the original message starting from the hash through a dictionary attack. Apr 26, 2018 at 13:50
-
@A.Darwin I know how hashes work, that is exactly my point. Preimage resistance only works when the preimage space is large enough, a preimage space of 10^10 is not large enough. Apr 26, 2018 at 14:01