Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
So, let's say I have a theoretical service. User has some text they want to encrypt. They pass it to me, and I encrypt it. Then, only I should be able to decrypt it afterwards. Another kicker, it must use a common key. The key can change occasionally, but not be user-specific or anything like that.
What can I do to avoid people analyzing the encrypted results of known text to find the key? I know there are things like Length Extension Attacks. What encryption algorithm would be safest?
If an encryption algorithm is susceptible to known plain text attacks, then it is fairly severely broken. Is there a reason that you don't use a public/private key encryption scheme? Then the user could actually encrypt it prior to transmission and you would still be the only one who could decrypt it. More ideally, you'd really want to have them choose a key, encrypt the data (symmetrically) with the key, encrypt the key with your public key, send the encrypted data and encrypted key to you, then if you need to use a common key, you could decrypt the data and re-encrypt it with your own key. This would give you protection while the file is in transit. (Alternatly, if it is a web service, simply using SSL for the transfer will do the same thing.)
Is there a particular reason you need to use the same key for every user? This is a big point of insecurity as it results in a single point of failure.
First, length-extension attacks apply to hash functions, not encryption algorithms. You don't need to worry about them here.
To answer your question, standard encryption algorithms (such as CBC) are secure against chosen-plaintext attacks, so in fact they are explicitly designed to be secure in this type of scenario---the ability to encrypt plaintexts of his choosing under an unknown key does not give an attacker useful information about that key (or about other ciphertexts).
If there is any possibility that an attacker can tamper with the ciphertexts (for example, you're sending them through an unauthenticated channel or storing them in untrusted storage), then you should follow the advice of CodesinChaos and also look into using authenticated encryption. Look up GCM or HMAC.
You said you'd be willing to accept this answer if I moved it from a comment, but I'd encourage you to take a close look at AJ Henderson's answer, too. The unusual requirements of this vaguely defined theoretical service leave me feeling a bit wary of making specific recommendations, but if his suggestion is practical, it's probably the way to go.
