Convergent encryption

Convergent encryption, also known as content hash keying, is a cryptosystem that produces identical ciphertext from identical plaintext files. This has applications in cloud computing to remove duplicate files from storage without the provider having access to the encryption keys.^[1] The combination of deduplication and convergent encryption was described in a backup system patent filed by Stac Electronics in 1995.^[2] This combination has been used by Farsite,^[3] Permabit,^[4] Freenet, MojoNation, GNUnet, flud, and the Tahoe Least-Authority Filesystem.^[5]

The system gained additional visibility in 2011 when cloud storage provider Bitcasa announced they were using convergent encryption to enable de-duplication of data in their cloud storage service.^[6]

Overview

1. The plaintext is hashed using a cryptographic hash.
2. The hash is then used to encrypt the plaintext.
3. The ciphertext is then uploaded to the cloud provider.

Known Attacks

Convergent encryption is open to a "confirmation of a file attack" in which an attacker can effectively confirm whether a target possesses a certain file by encrypting an unencrypted, or plain-text, version and then simply comparing the output with files possessed by the target.^[7] This attack only poses a problem for a user storing information that is non-unique, i.e. also either publicly available or already held by the adversary - for example: Banned books or files that cause copyright infringement. An argument could be made that a confirmation of a file attack is easily rendered ineffective by simply adding a unique piece of data such as a few random characters to the plain text before encryption; this causes the uploaded file to be unique and therefore results in a unique encrypted file. However, some implementations of convergent encryption where the plain-text is broken down into blocks based on file content, and each block then independently convergently encrypted may inadvertently defeat attempts at making the file unique by adding bytes at the beginning or end.^[8]

There is also a "learn the remaining information attack" described by Drew Perttula in 2008.^[9] This type of attack applies to the encryption of documents that are only a slight variation of a public document. These include marginal revisions of public document, filled public form... For example if defender encrypts a bank form including a ten digit bank account number, an attacker that is aware of generic bank form format may extract defender's bank account number by producing bank form for all possible bank account numbers, encrypt them and then by comparing those encryptions with defender's encrypted file deduce his bank account number.

See also

• Salt (cryptography)

References