I want to encrypt the files stored in SD card and I am using the CTR mode of AES to encrypt it. The key and IV are fixed. So each time I encrypt/decrypt I use the same key and nonce. Most of the people suggest not to use same nonce repeatedly. In my case since it is not the communication between two parties I think it is harmless. Is my assumption correct?
-
This is an incredibly dangerous thing to do, and the only discernible benefit is saving 32 bytes per file. I have to ask: Why?– Stephen TousetCommented May 22, 2015 at 18:35
Add a comment
|
2 Answers
You must not do this.
AES in CTR mode turns it into a stream cipher, such that AES is turned into a cryptographic pseudorandom number generator (PRNG) which generates a sequence of pseudorandom bits to be used as a keystream. This output keystream is simply xor'ed with the plaintext stream to produce ciphertext. Using the same key and IV produces the same keystream each time, so by re-using the key and IV you're essentially using a many-time pad.
So, you get:
C1 = M1 ⊕ K
C2 = M2 ⊕ K
Where C is ciphertext, M is the plaintext message, K is the keystream produced by AES-CTR, and ⊕ denotes an exclusive-or (xor) operation.
By computing the xor of those two ciphertexts, you get:
C1 ⊕ C2 = M1 ⊕ K ⊕ M2 ⊕ K
which, after cancelling out the two K values (since x ⊕ x ≡ 0) gives us:
M1 ⊕ M2
This allows an attacker to know which bits of M1 are equal to M2. If you know any bits of one message (known plaintext), you can then recover the corresponding bits from the other message. You can also employ techniques such as crib-dragging to fully decrypt the entire message.
There's a great answer on Crypto SE about exactly how this attack works.
You should always use a unique IV per message to avoid this problem.
answered May 22, 2015 at 10:16
-
I think the point of the question is that the asker believes that the adversary would not get hold of C₁, so this attack would not be possible. Commented May 22, 2015 at 10:18
-
2If his attack model is that an attacker can't get access to the encrypted data, why encrypt the data in the first place? Commented May 22, 2015 at 10:19
-
The model is that the attacker would only ever get the latest ciphertext, i.e. C₂, because the card is either in Rak's possession (then encryption is irrelevant) or stolen (with a single copy of the ciphertext). An answer here needs to explain why this is not a good model. Commented May 22, 2015 at 10:20
-
I'm not sure how you're inferring that from the question. Commented May 22, 2015 at 10:22
-
21) Attacker picks up SD card, copies off ciphertext. 2) Attacker puts SD card back where he found it. 3) You don't know attacker took SD card. 4) Attacker steals SD card again later, gets another ciphertext.– cpastCommented May 22, 2015 at 17:49
With identical key and IV, you'll produce identical ciphertext for identical plaintext.
Scenario: You send messages to your broker via this scheme, and don't worry about the messages being intercepted because you've encrypted them. C1 reads:
Stock: Cocoa-Cola Order: Buy Shares: 1,000,000 Price: > $20
Someone steals your SD card while you're not looking, and copies the ciphertext. Later on through other means, finds out you bought 100 shares of coca-cola.
Coke keeps going up, so you buy more shares. C2 reads:
Stock: Coca-Cola Order: Buy Shares: 3,000,000 Price: >$30
The attacker has noticed the first part of your message hasn't changed. Later on, you're observed buying 300 shares of coca-cola. Now the attacker has an idea of the format of your messages.
Coke is skyrocketing, so you decide to buy even MORE coke shares. C3 reads
Stock: Coca-Cola Order: Buy Shares: 5,000,000 Price: >$40.
The first part of the message is STILL the same, so the attacker has a damn good idea that you're going to buy Coke shares. He doesn't know how many, but based on past purchased he can have a good idea.
Thus your encryption has been foiled. Further messages back and forth will only break more and more of the ciphertext. This is similar to the scenario the NSA used against the Soviet union when the soviets re-used a one time pad in project verona https://en.wikipedia.org/wiki/Venona_project
answered May 22, 2015 at 18:30
-
-
Then what is the method to maintain a permanent key? Because the encrypted file has to be decrypted some other time with the same key isn't?– RakCommented May 23, 2015 at 6:16
-
@rak I think you've missed my point. Knowing the ciphertexts are the same is leaking information. If the attacker can determine "He's buying coca-cola again!", that's a real world break of the crypto. Cryptography should leak as little information as possible. I'm not certain how the permanent key details are relevant here. I'm describing a scenario where an attacker takes advantage of an implementation where IVs are re-used. This is a primitive scenario and there's more sophisticated ones, but it simply illustrates the point. Commented May 23, 2015 at 13:53