3

Background: I'm planning a setup that involves storing passwords as individual encrypted files (using the password manager pass), and then storing the private key needed to decrypt those passwords on a USB device with a push-to-decrypt button (such as a YubiKey).

Assuming only one file can be decrypted per press, even if some hypothetical malware hijacks the connection between my browser and the USB key it can only decrypt one password per intended use. And if it decrypts a different password from the one I requested, I'll be alerted by the fact that my intended login fails.

But this assumes that it's not possible to take two encrypted files and combine them into a single encrypted file, without decrypting first, in a way that the decryptor cannot detect1. If this were possible, clever malware could take all the password files and dump them into a single one, then just wait for me to use the USB key once and perform the above attack. This would render the physical button fairly useless.

So my question is: is there any guarantee that concatenating encrypted files is not possible, in general? Does it depend on the ciper used? (Obviously I am not planning to use homomorphic encryption.)

  1. I'm aware that some software supports (for example) multiple ASCII-armored PGP blocks in a single file, but those should be trivial for the decryptor to recognize as multiple pieces of encrypted data.
3

If you are using a reasonably sensible algorithm then there are 2 methods to protect against this kind of attack.

One is the security mode of the encryption. By selecting one which uses feedback (i.e. NOT ECB) decryption of the appended password would be dependent on the original password (which wasn't there when the appended password was encrypted).

The other is use of an initialization vector. This is a random string combined with the cleartext and also maintained alongside the ciphertext. Because each encrypted entity should have its own initialization vector, the appended password cannot be decrypted using the IV and key for the initial password.

  • Could you elaborate on the first method? It's too abstract for me to understand. The second method would be similar to using different keys for each encrypted file, right? Does it still work if the attacker has access to the initialization vectors as well? – phu Nov 14 '17 at 5:10
  • I think the Wikipedia article does a better job than I can of explaining security modes, Initialization Vectors are not intended to be secrets - if the attacker has access to the ciphertext, then they should have access to the initialization vector. It doesn't help them in this kind of attack. – symcbean Nov 14 '17 at 10:35
  • What I'm having trouble with is the connection between security modes and the non-concatenation property I'm concerned with; I don't see anything in the Wikipedia article that addresses this directly. – phu Nov 14 '17 at 11:30
1

@symcbean's answer is correct, but it took me a while to digest the Wikipedia article on block cipher modes and convince myself. For completeness, here's a more explicit explanation:

Encryption algorithms work by splitting the cleartext into blocks, and encrypting each block according to a particular block cipher mode. All commonly-used modes combine the previous block with the next block before encrypting (e.g. by XORing with the previous block's ciphertext) in order to resist known-plaintext attacks. (The first block is combined with a randomly-generated block called the initialization vector instead.)

Since our attacker wouldn't have access to any cleartext, he can't replicate this process for any blocks he'd wish to append.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.