Score:1

Deterministic salt for KDF

cn flag

What would be recommended way to make deterministic password based file encryption?

I can use SIV mode, but KDF (like Argon) takes salt for which I could use SIV tag, but I cannot make it because I need key first.

I could use hash of file contents as salt, but that would make it 3-pass. If I would use some other single pass authenticated mode with IV generated with KDF, it would be 2-pass. Is there a better way?

EDIT: I changed my question (HKDF to KDF). I actually meant KDF generally (I had something like Argon in mind, not HKDF).

kelalaka avatar
in flag
Why not prepend the random salt to the encrypted file?
cn flag
@kelalaka You cannot, if you don't have reliable random/unique source.
kelalaka avatar
in flag
It is not you cannot, it is I cannot since you don't have a random/unique source.... You should detail more about your constraints...
cn flag
@kelalaka Constraint is it has to be determistic encryption. It is more theoretical question as fallback in case I have limited or unreliable environment.
Marc Ilunga avatar
tr flag
It seems more details on what is the goal and what has been tried is needed. HKDF supports fix salts and that is a secure KDF via indifferentiability. Also, care must be taken with how the salt is generated. A file depend salt means the attacker has potential control over the salt in a CPA setting.
cn flag
@MarcIlunga Can attacker controlling salt make it worse than no salt?
Score:1
in flag

HKDF doesn't require a salt. It does make the HKDF stronger, but in principle you can just use it without salt (or, if you're not sure, with an unreliable salt).

The salt is mainly there required when password-based encryption is used to protect against rainbow tables and identifying identical passwords. However, in this case with SIV mode you'd only be able to reliably detect identical files encrypted with the same password. The main problem seems to be the password based encryption itself.


Personally I would try and use asymmetric cryptography for this: encrypt the file using a public key (hybrid cryptography, encrypting or deriving a random AES key for each file) and protect the private key using a password and a real random salt. Then you can store the well-protected private key somewhere next to the file (or, preferably, somewhere more secure). You'd also not have to perform the PBKDF for each file, once you have the private key in memory.

Beware that many asymmetric algorithms are not secure against a full fledged quantum computer. So you might want to have another look if you want to protect your files against adversaries in the long term.

It should also be noted that, given a public key, anybody is able to encrypt. That could be a problem as an adversary may, for instance, swap or insert ciphertext without having a key.


Note that, if you remove time from the equation, that the full path is usually unique for each file. So if you'd hash that you'd have a pretty good deterministic salt - which you could also mix with a non-reliable salt. You should probably still store the salt as not to make decryption rely on that full path.

cn flag
I changed my question. I actually meant KDF generally (I had something like Argon in mind not HKDF), but I think it does not make any difference.
Maarten Bodewes avatar
in flag
Hmm, that's debatable. HKDF is a key based KDF (KBKDF) while Argon is a password based KDF (PBKDF). For HKDF a salt enhances security (and many KDF's don't accept a salt as explicit / separate input parameter), while for a PBKDF a salt is a necessary parameter.
cn flag
Using some unreliable salt like some poor jitter or coarse timestamp or file path still seems reasonable protection against rainbow tables. Although I still kinda like idea of hashing file contents and using some single pass to encrypt, if files are small enough.
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.