1

I have at most 10,000 files that I want to store encrypted with one password.

The current idea is:

  1. Have 1 master file containing (expensive) parameters for scrypt.
  2. For encryption/decryption hash a user password with the given parameters and use it as key for symmetric cipher encryption/decryption
  3. Each file is prefixed with a cryptographic secure random nonce that is unique(only used once)

My questions:

Is this generally wrong?

Is a single password/derived key enough or

  1. Should I derive a new key for each file (I worry the time it takes)?
  2. Should I derive a new key for a bulk of files (e.g. every 100)?
Jedi
  • 3,936
  • 2
  • 24
  • 42
Krampenschiesser
  • 13
  • 2
  • Your question needs a bit more context. What threat are you worried about and what problem are you trying to solve? Are you considering how you are going to store the one password will it be on a remote system or stored and used locally? Are you worried about the password staying in memory? Are you concerned about local users accessing the files or more about remote attackers or more about the physical theft of the device? How does this security control work together with others? Putting your question into context can help a lot. – Trey Blalock Apr 22 '17 at 21:34

1 Answers1

1

Is this generally wrong?

I see two problems with your implementation:

  1. Using random prefix instead of IV

    This technically could be done but it is not recommended or encouraged. Please see this for more details. Generate random IV for each file and save it along with ciphertext (as a prefix or suffix).

  2. Using derived key directly as an encryption key.

    In case a password is changed you will need to decrypt and encrypt all of the files again. To solve this, you should generate a single random encryption key that will be used for encrypting all of the files. You will then encrypt this key with a master key derived from user password and save it in a separate file. When password is changed (and consequently master key), you will only decrypt and encrypt the file containing the encryption key. For an example of a well known implementation that uses similar schema take a look at DPAPI and how it handles the keys.

Is a single password/derived key enough or

  1. Should I derive a new key for each file (I worry the time it takes)?
  2. Should I derive a new key for a bulk of files (e.g. every 100)?

This depends on what are you defending against. Considering my comments above, you will not derive each encryption key out of the user password but rather generate them randomly from a strong CSPRNG. If you have new random encryption key for each file you will need to store the encryption key encrypted with master key along with ciphertext and IV. If the file encryption key is compromised only that one file is compromised. You need to think if it is possible for a single encryption key to be compromised without compromising the master key (brute force?). If this scenario is not likely or you choose not to defend against it, you can use single encryption key for all files.

One more thing to consider when using single key for all of the files is how large data encrypted with single key can be before you need to change the key. For an answer to this question please see this and this.

Marko Vodopija
  • 1,062
  • 1
  • 8
  • 19