Concatenating files encrypted by same key

Question

Background: I'm planning a setup that involves storing passwords as individual encrypted files (using the password manager pass), and then storing the private key needed to decrypt those passwords on a USB device with a push-to-decrypt button (such as a YubiKey).

Assuming only one file can be decrypted per press, even if some hypothetical malware hijacks the connection between my browser and the USB key it can only decrypt one password per intended use. And if it decrypts a different password from the one I requested, I'll be alerted by the fact that my intended login fails.

But this assumes that it's not possible to take two encrypted files and combine them into a single encrypted file, without decrypting first, in a way that the decryptor cannot detect¹. If this were possible, clever malware could take all the password files and dump them into a single one, then just wait for me to use the USB key once and perform the above attack. This would render the physical button fairly useless.

So my question is: is there any guarantee that concatenating encrypted files is not possible, in general? Does it depend on the ciper used? (Obviously I am not planning to use homomorphic encryption.)

1. I'm aware that some software supports (for example) multiple ASCII-armored PGP blocks in a single file, but those should be trivial for the decryptor to recognize as multiple pieces of encrypted data.

Answer 1

If you are using a reasonably sensible algorithm then there are 2 methods to protect against this kind of attack.

One is the security mode of the encryption. By selecting one which uses feedback (i.e. NOT ECB) decryption of the appended password would be dependent on the original password (which wasn't there when the appended password was encrypted).

The other is use of an initialization vector. This is a random string combined with the cleartext and also maintained alongside the ciphertext. Because each encrypted entity should have its own initialization vector, the appended password cannot be decrypted using the IV and key for the initial password.

Answer 2

@symcbean's answer is correct, but it took me a while to digest the Wikipedia article on block cipher modes and convince myself. For completeness, here's a more explicit explanation:

Encryption algorithms work by splitting the cleartext into blocks, and encrypting each block according to a particular block cipher mode. All commonly-used modes combine the previous block with the next block before encrypting (e.g. by XORing with the previous block's ciphertext) in order to resist known-plaintext attacks. (The first block is combined with a randomly-generated block called the initialization vector instead.)

Since our attacker wouldn't have access to any cleartext, he can't replicate this process for any blocks he'd wish to append.