5 ms·
tzs's scheme proposes encrypting files with the hash of their contents (see http://news.ycombinator.com/item?id=2461713 http://news.ycombinator.com/item?id=2461
by sweis 15y ago
tzs's scheme proposes encrypting files with the hash of their contents (see http://news.ycombinator.com/item?id=2461713 http://news.ycombinator.com/item?id=2461713).
That's not semantically secure. Anyone can distinguish whether a particular plaintext produced a given ciphertext.
- Dylan16807 15y agoWell, yes, that's the point of the deduplication. If you already have the same exact file, in its entirety, you can check if it's in the system or not.
- tlrobinson 15y agoTrue, but I don't think that's a concern for most people. What are the practical implications? The only one I can think of is if someone were trying to prove in court that you had a particular file. A related question I've been wondering about is whether a hash or key+ciphertext are considered proof of possession of the original file. In theory an infinite number of files have the same hash, and the ciphertext could have been produced using a different key (or it could just be random data). In practice it's extremely unlikely (for sufficiently secure hash and encryption functions). What are the laws'/courts' views on cryptography?
- IgorPartola 15y agoDoesn't the theory of infinite collisions existing, require that you are nit restricting the file size? The combination of "the hashes match" and the file sizes are roughly the same would seem to go beyond a reasonable doubt.
- Dylan16807 15y agoNot really. Let's use for example a 256 bit hash and a 1KB file. That means you have about 2 ^ (1024 * 8 - 256) collisions that are the exact right size. Close enough to infinite for any file that's at least a hundred bytes. The more pressing concern is how hard it is to fake a particular hash.
- InnocentB 15y agoHowever, Igor's statement does hold true for (some) hashes that are at least as long as the maximum file size :P
- IgorPartola 15y agoThanks for explaining. +1.
- bxr 15y ago>True, but I don't think that's a concern for most people. But that is the kind of thinking that lead to the whole issue with Dropbox in the first place. Its deceptively "secure" to any user who can't analyze the implementation implications themselves.