I was thinking of implementing the following scheme for encryption of many independent files:

  1. From the password, which is given by the user, generate a master key using for example HMAC-SHA.
  2. From this master key, a subkey is derived for each file. Combined with a random and unique token which is stored alongside the file, HKDF-expand might be used for this where the info is the random token.
  3. Each file is combined with a random IV and is encrypted using AES using the derived subkey.

My idea behind this is that even if an attacker were to break the encryption (i.e. somehow found the key) for a single file, all other files would still be secure because they were all encrypted using a different subkey. Does this make sense or is it easier to "reverse-engineer" the master key from a subkey if one is found?

(As as side-question, is it ok to use such a random token for HKDF-expand? Does it provide better security than a non pseudo random string such as the file name or an increasing counter?)


Think of Kerckhoffs's principle. The attacker will know that you derive all file passwords from the single master password. Thus it will make sense for the attacker to try to get the master password, not the derived ones. And if the attacker gets it, all your files can be decrypted. Thus I don't see any difference in the security risks between your scheme and encrypting all files directly with the same password.

This question may look similar to this one, but is actually completely different. In that question there are many parties (applications), each needing its own password. But your case is different. In your case there is a single party that will use them, it is you. That's why there are no key distribution channels (that could be targets of the attacks), there are no other parties (that could be targets of the attacks). Thus there is no sense for the attacker to try to find passwords for single files. The main reasonable target would be the master password. That's why the whole described scheme will not give any additional security and the master password alone will give the same security.

I see the generation of the master password (like using secure PRNG or using good KDF to derive the effective password) as out of scope of this question.

  • This is a partial answer for the OP. The real guidance is missing. The strength of the password is missing, and advising to use dicewire is necessary. Then with HKDF, they can derive multiple keys and IV's; Multiple AES Key Derivation from a master key
    – kelalaka
    May 18 at 19:52
  • @kelalaka: What you describe is completely other case. In your case there are multiple parties and multiple attack targets. For such case your remarks would be correct. But the OP describes completely different case with a single party. I don't give any guidance, because I say that what the OP describes does not make much sense and I discourage to implement this scheme. I have extended the answer to address it.
    – mentallurg
    May 19 at 0:15
  • @kelalaka: I don't understand your point. I assume the author does already have a secure password, no matter how it was generated. I say that derivation for every file is not needed and a single password should be used. That's why steps 1 and 2 are not needed at all. That's why I don't discuss HMAC-SHA and HKDF.
    – mentallurg
    May 19 at 0:24
  • @kelalaka: We are still talking about different things :) Please explain why would one need multiple passwords for a single user?
    – mentallurg
    May 19 at 0:46
  • @kelalaka: OK :) Why do we need multiple keys if all of them will be used by a single user?
    – mentallurg
    May 19 at 3:12

About your concern which the mentallurg's answer did not address, yes it should be safe to derive keys from the master key and compromise of derived key should not compromise your master key if your KDF uses a secure pseudo-random function, which HMAC used by HKDF is assumed to be. [NOTE: If you are not very familiar with cryptography, you might worry about the use of word "assume" here. It is something that has gone through enough scrutiny but hasn't been proven or disproven like long standing mathematical conjectures]. However, as mentallurg's answer mentioned, an attacker will likely target your master key instead as it is a much bigger reward, and also since it also needs to be stored somewhere. So, it will be accepting single point of risk with a very big consequence, i.e. trading some security for efficient use and better user experience.

EDIT: It seems master key is derived from the password rather than stored. Then it is just as vulnerable to brute force/dictionary attacks as any password based encryption system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.