Background: I'm planning a setup that involves storing passwords as individual encrypted files (using the password manager
pass), and then storing the private key needed to decrypt those passwords on a USB device with a push-to-decrypt button (such as a YubiKey).
Assuming only one file can be decrypted per press, even if some hypothetical malware hijacks the connection between my browser and the USB key it can only decrypt one password per intended use. And if it decrypts a different password from the one I requested, I'll be alerted by the fact that my intended login fails.
But this assumes that it's not possible to take two encrypted files and combine them into a single encrypted file, without decrypting first, in a way that the decryptor cannot detect1. If this were possible, clever malware could take all the password files and dump them into a single one, then just wait for me to use the USB key once and perform the above attack. This would render the physical button fairly useless.
So my question is: is there any guarantee that concatenating encrypted files is not possible, in general? Does it depend on the ciper used? (Obviously I am not planning to use homomorphic encryption.)
- I'm aware that some software supports (for example) multiple ASCII-armored PGP blocks in a single file, but those should be trivial for the decryptor to recognize as multiple pieces of encrypted data.