2

I'm working on a simple secure mirror for potentially untrusted services like Dropbox, Owncloud and so on. (Current code may be seen here: http://www.codeduce.com/extra/secure_mercurial)

Currently I'm relying on 7zip for encrypting the individual files. So, I am encrypting every file with a password and mirror it to the watched directory of the service.

Question: There will be many of those files, all using the same password. Does this lower the security of AES256? I mean is there any possibility getting the key faster, if one has several encrypted samples?

If so, is there a better tool/algorithm for that situation?

Improve this question

2 Answers 2

Reset to default
3

How secure?

Your approach sounds good. But, read on.

If so, is there a better tool/algorithm for that situation?

There always is, but nothing I'm familiar with is significantly better, this tool is likely good enough.

Details of 7zip encryption

There has been previous questions and answers on 7zip encryption:

From these it is easy to conclude the answer to your question: 7zip uses key derivation practices which appear pretty good. Also it uses salt. Therefore, all files will be most likely using different encryption keys.

Possible issues

Most likely the weakest link will be the entropy of password you have chosen, therefore choose the password carefully. A low-entropy password will still be easy to break. For instance, if password is a common dictionary word, it may take attacker only a few minutes to guess it. Please, use good password/passphrase choosing practices.

Do you intend to retain the original files? (I.e. is this a backup?) If yes, you must ensure the unencrypted files are never readable by attackers. If you erase the original files try to make sure files are entirely erased.

Last, but not least, remember that if you are using single password for all files, if attacker is able to guess that one key, they'll be able to decrypt all the files encrypted under that key.

DISCLAIMER: I have not reviewed the source code of 7zip, but answer is based on other sources.

Improve this answer
2
  • Thank you. Since you talk about unencrypted files: Would the combination one unencrypted file and that file encrypted allow to calculate the key?
    – Mike M
    Commented Jan 6, 2014 at 17:04
  • No. That would only allow attacker to access the very portions of files s/he is able to find. Earlier response to question on AES plaintext key recovery attack tells that AES-128 (as well as AES-256) is resistant against trying to recover key via known plaintext.
    – user4982
    Commented Jan 6, 2014 at 17:13
3

Using the same key on multiple files is no different from using a single key on one big file that contains all the small files. If the encryption itself is secure, the number of files using that key does not matter unless the encryption is inherently broken. As long as the key selection is strong and the encryption algorithm is strong, then the encryption should be fine.

You only need different passwords when you need to limit exposure. This is why different passwords are recommended for different accounts, because you don't want a compromise of one account to compromise other accounts, but for files on a single account, using one password is fine as long as you don't mind them all getting compromised if one gets compromised.

Improve this answer
5
  • In the worst case (password reused with no salt at all), knowing the plaintext for a single file could allow decrypting the rest of encrypted files. The way it is implemented matter!
    – Ángel
    Commented May 13, 2015 at 22:25
  • 1
    @angle - If knowing the plaintext and ciphertext gives away the key, your algorithm is SERIOUSLY broken. Note that I specifically indicated that my answer is only relevant if the key selection and encryption algorithm is strong.
    – AJ Henderson
    Commented May 14, 2015 at 6:13
  • It's not the algorithm (eg. AES) but the cipher mode (eg. CTR) if you are reusing the key and you are not using a IV (additionally the attacker needs a pair of plaintext and ciphertext). Obviously, if you're doing everything right, there's no hole, but often the problem is not the crypto itself but the way it is (mis)used.
    – Ángel
    Commented May 14, 2015 at 17:07
  • @Ángel- um, no... what you describe is a KPA (known plaintext attack). There currently isn't any major KPA against AES (at least not that I've heard of). There are stronger and weaker block modes for other attacks, but you are talking specifically about KPAs and drastically failing KPAs, of which there are none for AES currently.
    – AJ Henderson
    Commented May 15, 2015 at 5:53
  • More specifically, in a real worst case scenario, the chaining mode won't matter. Chaining only means that the current state depends on the previous iterations of the algorithm. If the first phrase of the encryption is able to be broken, then any subsequent ones could still be broken though and the IV is going to be known since the IV is not protected data. It is the job of the algorithm to ensure that you can't figure out the key from a set of plaintext and cipher text.
    – AJ Henderson
    Commented May 15, 2015 at 6:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .