1

I've been storing files using a filename of the md5 hash of the file. This allows me to not store duplicates of the same file and avoids any filename clashes. Each file has uses a different salt/iv.

I want to start encrypting the contents of the file app-side (using OpenSSL PKCS5), however, by taking the md5 of the encrypted file, I lose the above benefits of the md5 filename.

Assuming the file storage was compromised, would the combination of the encrypted file and the md5 of the unencrypted file be a potential security issue?

0

If the possible range of the file's contents were small enough (either because the file is very short, because the attacker knows every part of the file except for a very short piece, or because the attacker knows the file's contents are one of a limited set of things, then the attacker can perform a brute-force search of the possible file contents and check the hash digest of each result to see if it matches the filename.

Note that this vulnerability has nothing to do with the fact that MD5 is cryptographically broken and deprecated; any hash function would be vulnerable to the same issue. If you want to avoid the risk, you need to either avoid encrypting small / predictable files, or you need to not leave each file's plaintext hash digest hanging out in plaintext (the filename) itself.


Another attack that might be possible is if the attacker knows at least some of the files you have stored, and can generate a new file for you to store. Because MD5 is broken, the attacker could potentially craft a malicious file that has the same MD5 as a file you care about, and then when you store the attacker-supplied file you would overwrite your original file because it would have the same name. The use of encryption is irrelevant here (except to the extent that it makes it harder for the attacker to know what files you have stored); this is simply a consequence of doing file de-duplication using an algorithm for which we know how to create collisions and (partial) pre-images. To avoid this risk, don't let a potential attacker know what files you stored, don't store files a potential attacker supplies, and/or move to using a secure hash algorithm such as a member of the SHA2 or SHA3 families.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.