What's the point of encrypting a session key with a master for file backups?

Question

I was reading the Arq backup data format specification. In short (if I've understood right) it is:

• Generate password protected master key
• Generate random session key
• Encrypt plain text with session key
• Encrypt session key with master
• Concat encrypted session key with encrypted text

The document says the session key is only used for 256 objects before it is replaced. What's the point of generating a session key each time if you can attack the master for the same (or better) result? I don't see anything that says the master is replaced every 256 uses.

I'm assuming the master and session key are of equal strength. The master key is generated via PBKDF2/HMACSHA1 (200000 rounds) and it is used with AES256-CBC.

This is a specific example, but I guess it's the same in more general circumstances. I can see some benefit to this with communication methods to protect against MITM as the attack might not get hold of more than one communication stream, but with backup files I guess you'd find a large number of files, and possibly several backups, all stored in the same place.

I'm probably missing an obvious principle so I would be grateful for any insight given.

Answer 1

There are two different requirements in play here: one functional requirement, and one security requirement.

The functional requirement is that the master key should be able to be changed without the need to decrypt all of the data, and the re-encrypt it with the new key. This is why you have session keys that are encrypted with the master key. Specifically you have a key-encryption-key (the master key) and data-encryption-keys (what they're calling session keys.) This means that when you want to change the password that is used to derive your master key, you only need decrypt and re-encrypt the data encryption keys, not all of the data.

The second issues, which is the security requirement, is that it is only safe to encrypt some number of blocks with a single encryption key. With AES, which uses 128bit blocks, it's quite a lot of data, but it is still a finite amount. With smaller 64bit block ciphers like Triple-DES, the limit is much lower, resulting in issues like the Sweet32 attack on 3DES ciphersuites disclosed last year. This is likely why they've decided to re-key every 256 uses, because file backups mean that they're potentially encrypting a lot of data in those 256 encryptions. When you're dealing with encrypting keys, however, they're tiny. Only 32 bytes each for AES256, so no matter how many you encrypt with your single master key, it simply isn't an issue.