I'm working on a project to encrypt many files with a single password.
The steps I will employ to encrypt the files are:
- user will execute a command similar to
tool --encrypt --recurse directories/to/recurse and-other-files.txt
- the user will be prompted for a password
- two 64 byte crypto random salts and a 16 byte crypto random IV will be generated
- no 2 files will ever use the same salts or IV
- each individual salt will be combined with the password to create to 2 separate argon2id keys
- one key will be 32 bytes long and is used for the AES-256 cipher block
- the other will be 64 bytes long and will be used as the key for a sha-512 hmac
- the resulting encrypted file will be written as
I believe this would result in a reasonably secure, set of encrypted files. My main concern though, is that because of the way that users will use this tool, there is a good chance that they will accidentally encrypt small, easily guessed files.
And since CTR mode doesn't require padding, anyone with access to the encrypted file will know the length of the plaintext file. It seems that CTR mode is considered secure for files, provided the IV is unique for each encryption run and the file is authenticated.
Is there a chance that the cipher key, HMAC key, or password could be derived through a known plaintext attack from enough small guessable files? Are there any other glaring flaws in my methodology that could leak data?