3 ms·
The point of reusing the IV is that identical blocks of data encrypt identically. That's the information that is leaked. That's the behaviour required by rsync
by papaf 17y ago
The point of reusing the IV is that identical blocks of data encrypt identically. That's the information that is leaked. That's the behaviour required by rsync to efficiently transfer changes.
Is it really so bad?
- cperciva 17y agoDepending on your attack model, yes, it really can be that bad. Much better to do your deduplication on the plaintext.
- hga 17y agoBut this is not trying to address a duplication problem as far as I can see (see below): E.g. let's say I have the following blocks of data: A B C D E F... And I then change C to C', now having: A B C' D E F... With the rsynccrypto approach the ciphertext of D E and F... will be unchanged, allowing rsync to do the right thing (not retransmit everything after C'). Yeah, this leaks info, but it's a compromise between a making the result easier to break and conserving transmission costs (which is very much an issue for me, being stuck behind a slow upstream residential ADSL link). My question, which I have most definately not answered to my complete satisfaction, is "has the cryptosystem been compromised to the point I might as well have not bothered?" Just how easy will the know leaks make a attack feasible? How expensive would be such an attack be? I.e. I'm not concerned about the NSA, a lesser degree of security is OK. As for deduplication, I don't see how it can help; could you be more specific? (And thanks a lot for taking this issue seriously, it is something I'm concerned about and don't have a sufficient background to be all that confident about my judgment.)