I'm working on a file encryption system where multiple versions of the same file might exist. The filenames are encrypted using AES in CBC mode with a random IV and stored in metadata. Since versions of the same file share the same filename, this information may be used by an adversary. Is there any additional information to be derived from multiple ciphertexts which are known to share the same plaintext, just with a different IV?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
Sign up
Sign up
Here's how it works:
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
|
No. Giving the attacker multiple encryptions of a single plaintext using a randomly chosen IV and a fixed key with AES-CBC does not leak any more information about the plaintext than does a single ciphertext. In fact if the attacker didn't know whether or not they were the same plaintext (but had the same length), the attacker couldn't tell you whether or not they encrypted the same plaintext. |
|||||
|
|
If you use a random IV each time you encrypt a file, the result will be different. $$\text{AES-CBC}(IV_1, Key, M) = C_1$$ $$\text{AES-CBC}(IV_2, Key, M) = C_2$$ you do not gain any pieces of informations by having $C_1$ and $C_2$. Even knowing that they share the same key and should they share the same length, an attacker can not even know whether or not they are the same file (identically byte to byte). This is the goal of the $IV$. Therefore he would not be able to find or exploit differences between plaintext with similarities. Hence you are perfectly fine with your scheme. The only informations that could be leaked is the date of creation and the size of the content. But it is hard to fight against that. |
|||||||||
|
