Files and Folders Not Getting Random IVs

Janus184

I took a random sampling of 20 files and folders encrypted by Boxcryptor. I opened the encrypted file (.bc) in Notepad (in the case of folders, FolderKey.bch) and recorded the IV values. Across those 20 files/folders, I saw all files and folders reused the same IV. I was able to create files and folders with identical plain text, and the resultant cipher text was also identical (due to IV reuse).

Boxcryptor version 2.0.405.295 running Windows 8.0 & 8.1 x64 with and without filename encryption enabled.

Robert

Hello Janus184,

Thank you very much for your message. Indeed, I have to confirm that the IV is the same for all files (or folders) created during a session in the current Boxcryptor for Windows version 2.0.405.295. If Boxcryptor is restarted, the IV changes. This is actually a bug and we will fix it asap in the next version which will be available soon.

Although this is not ideal, it is not a security risk because every file has its own random key. So no two files are encrypted with the same key. IVs are required if the same key is used for multiple files but if a key is used only for a single file, different random IVs are not required for security. For AES-CBC it is important that a combination of IV and key may only be used once - in our case this is the case even if the IV is reused over different files because each of the files has its own and different key.

I highly doubt that creating two different files with the same plain text results in encrypted .bc files which have the same cipher text (without copying the encrypted .bc files). It would be interesting if you could send the encrypted .bc files to support@boxcryptor.com so that I can have a look at them.

Best regards,
Robert

Janus184

Hello Robert,

You are correct, the actual contents of two identical files is different. What is the same, is the file name. Same is true for the folder name. I.e. two folders (or two files) with the same unencrypted name have the same encrypted name. (When filename encryption is enabled.)

Thanks for your prompt attention,
Janus184

Robert

Hello Janus,

Yes, this is correct behavior. In order to provide a virtual drive or volume (with reasonable performance and encrypted filename lengths) an important requirement for filename encryption is that two same plaintexts result in the same ciphertext when the same key is used (and thus the IV is the same). However, a different plaintext has a different IV, so still two different filenames are using two different IVs.

The only information you could derive is that two different files have the same filename or not - but nothing more.

Filename encryption is a very difficult field because all information required for decryption must be placed into the encrypted filename and this space is VERY limited (e.g. maximum path length on Windows for many applications is 260 characters - not much room for data). We have put a lot of research into it and we have found a great solution with a good balance of security and usability. Of course, we're still trying to optimize it.

Best regards,
Robert