Convergent encryption

Convergent encryption, also known as content hash keying, is a cryptosystem that produces identical ciphertext from identical plaintext files. This has applications in cloud computing to remove duplicate files from storage without the provider having access to the encryption keys. The system was first mentioned by John Pettitt on the cypherpunk's mailing list in 1996 and has been used by Farsite, Freenet, MojoNation, GNUnet, flud, and the Tahoe Least-Authority Filesystem.

The system gained additional visibility in 2011 when cloud storage provider Bitcasa announced they were using convergent encryption.

Overview

1. The plaintext is hashed using a cryptographic hash.
2. The hash is then used to encrypt the plaintext.
3. The ciphertext is then uploaded to the cloud provider.

Known Attacks

Convergent encryption is open to a "confirmation of a file attack" since if the attacker knows the plaintext of the file, they can then check if a user has this file. This attack may only be a problem for a user storing information that is also publicly available - e.g. banned books or files that cause copyright infringement.

There is also a "learn the remaining information attack" described by Drew Perttula in 2008. This type of attack applies to the encryption of documents that are only a slight variation of a public document. These include marginal revisions of public document, filled public form... For example if defender encrypts a bank form including a ten digit bank account number, an attacker that is aware of generic bank form format may extract defender's bank account number by producing bank form for all possible bank account numbers, encrypt them and then by comparing those encryptions with defender's encrypted file deduce his bank account number.

See also

• Salt (cryptography)