using same symmetric key for multiple files

[Phillip Gardner]

Thanks very much for your detailed reply
which was very helpful.

On Mar 6, 2013, at 12:57 PM, Peter Lebbing <peter at digitalbrains.com> wrote:

> On 05/03/13 19:52, Phillip Gardner wrote:
>> gpg2 --symmetric --force-mdc --cipher-algo AES256 backup20130405.tar
> 
>> Is it a problem using the same key when encrypting multiple files which will
>> all be stored together? These files were very similar in content prior to
>> being encrypted.
> 
> 1) It is irrelevant that the files were similar. The passphrase you choose is
> used to encrypt a random session key, and the random session key encrypts the
> data. So the passphrase never "comes into direct contact" with the data
> cryptographically.
> 
> 2) While in theory there are attacks thinkable that can exploit the fact that
> the passphrase is the same each time, the passphrase is also salted before being
> used as keying material, so the actual key used changes each time. The material
> being encrypted also changes each time (the random session key with an algorithm
> specifier prepended), and is very small.
> 
> I doubt an attacker would gain something by having multiple Symmetric-Key
> Encrypted Session Key packets all created with the same passphrase. But some of
> the experts here might know a sweet attack. Or some of those nasty experts that
> don't share it here but rather go after your data.
> 
> I think you're safe. But why don't you just create a keypair and encrypt to
> yourself? It does obviously mean you should have a good backup of it somewhere,
> outside Florida, even though you love in Florida. Spread the love! ;)
> 
> There is the slight thingy that someone can replace your encrypted data with
> other, also correctly decrypting data, since your public key is usually public.
> So you should sign then too if you're worried about that.
> 
> HTH,
> 
> Peter.
> 
> -- 
> I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
> You can send me encrypted mail if you want some privacy.
> My key is available at <http://digitalbrains.com/2012/openpgp-key-peter>