1

I know how AES encryption works, and different modes (for example EAX, CBC, CCM, ...), and also about CipherBlock and StreamTransformationFilter methods and their implementation in C++.

I am using the Crypto++ toolkit. I want to use EAX mode for encrypting a file, and use AuthenticatedEncryptionFilter method for encryption as StreamTransformation. Now, what if using of a single key and IV for encrypting each file? Is it safe to use the same key and IV? If not, how do I use different keys and IV for encrypting a file and where to store the keys and IVs?

1 Answer 1

1

Using the same Key and IV pair for multiple file encryption is very dangerous because encrypting the two files with the same same content will result the same ciphertext for any block mode encryption. Here are a few related posts about this:

Why must IV/key-pairs not be reused in CTR mode?

Dangers of using CTR mode for encryption

AES-CBC and IV — Encrypting multiple blocks of a file with the same IV?

It is insecure to reuse the IV with AES-CBC. At the very least, if the files have a common prefix, this will be revealed as a common prefix of the ciphertexts. For AES-CBC, the only way to ensure confidentiality is to use random IVs.

What are the constraints for an IV using AES in CBC mode?

The IV for a block cipher in CBC mode must not only be "uniquely used for each message encrypted with the same key". It is usually assumed to be indistinguishable from random by an adversary.

Note that using the same key and iv pair for GCM mode would result disastrous consequences in any case. You can check the following question (in fact, in most of questions related to GCM mode, you would see people mentioning this case of wrong usage. )

How bad it is using the same IV twice with AES/GCM?


My advice is to use random symmetric key and random IV for each file encryption and store these in the encrypted file using Cryptographic Message Syntax(CMS), you can use EnvelopedData content type in which you store encrypted content. In this case, the content encryption key(CEK)(random symmetric key) is encrypted using the user's public key (could be reached from user's certificate) and stored as encrypted with the encrypted content. As for the random IV, it is stored as open because it does not need to be private it only needs to be unpredictable. When a user needs to decrypt a file, s/he basicly decrypts CEK using the private key that s/he has. From there, using CEK and the IV one can decrypt the encrypted content.

If you cannot or would not want to use CMS, you can use the same key with different IVs for multiple files encryption. I dont know any weakness for this use. You should store your key as encrypted but you can store the IVs as unencrypted. Note, you may want to store them as signed to see if they are changed or not without your notice.

9

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .