Problem - Kevin Tafuro

5.15 Performing File or Disk Encryption
Problem
You want to encrypt a file or a disk.
Solution
If you’re willing to use a nonce or an initialization vector, standard modes such as
CBC and CTR are acceptable. For file-at-a-time encryption, you can avoid the use of
a nonce or IV altogether by using the LION construction, described in the “Discussion”
section.
Generally, keys will be generated from a password. For that, use PKCS #5, as discussed
in Recipe 4.10.
Discussion
Disk encryption is usually done in fixed-size chunks at the operating system level.
File encryption can be performed in chunks so that random access to an encrypted
file doesn’t require decrypting the entire file. This also has the benefit that part of a
file can be changed without reencrypting the entire file.
CBC mode is commonly used for this purpose, and it is used on chunks that are a
multiple of the block size of the underlying block cipher, so that padding is never
necessary. This eliminates any message expansion that one would generally expect
with CBC mode.
However, when people are doing disk or file encryption with CBC mode, they often
use a fixed initialization vector. That’s a bad idea because an initialization vector is
expected to be random for CBC mode to obtain its security goals. Using a fixed IV
leads to dictionary-like attacks that can often lead to recovering, at the very least, the
beginning of a file.
Other modes that require only a nonce (not an initialization vector) tend to be
streaming modes. These fail miserably when used for disk encryption if the nonce
does not change every single time the contents associated with that nonce change.
Keys for disk encryption are generally created from a password. Such
keys will be only as strong as the password. See Recipe 4.10 for a discussion
of turning a password into a cryptographic key.
For example, if you’re encrypting file-by-file in 8,192-byte chunks, you need a separate
nonce for each 8,192-byte chunk, and you need to select a new nonce every sin-
Performing File or Disk Encryption | 213
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.