Encrypted Archive Key Validation via MAC Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure archive storage systems face vulnerabilities when using the same password for multiple archives, as it simplifies unauthorized access and are inefficient in changing passwords due to the need to re-encipher large archives across multiple volumes, which is time-consuming and resource-intensive.
Innovation Solution
The system enciphers an archive key with the passphrase and uses a Message Authentication Code (MAC) key derived from the passphrase and archive key, allowing for quick validation of encrypted keys without a standard header, and only requires updating specific values when changing the passphrase.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the same password is used for multiple archives, then the enciphering process is simplified and faster, but the security is compromised because the same key is generated for each archive making it easier to crack
Solution Approach 1:
The system segments the key management by generating a unique key for each archive through a key derivation function that combines the password with archive-specific metadata (such as archive ID or filename). This allows the same password to be used across multiple archives while producing different keys, thus maintaining both security and operational simplicity.
2Reliability
If the password is changed, then security is improved by using a new key, but the entire archive must be re-enciphered which is time-consuming and resource-intensive
Solution Approach 1:
The system extracts the key derivation process from the archive data itself. By storing the archive metadata that feeds into the key derivation function, the system allows password changes to only require updating the metadata and re-deriving the key, without needing to re-encipher the entire archive. This separates key management from data storage.
Solution Approach 2:
The system performs preliminary key derivation by pre-computing and storing the relationship between passwords and keys in the archive metadata. When a password change is needed, the system has already prepared the framework to quickly generate new keys without processing the entire archive, thus reducing the time and resources required for password changes.
3Adaptability or versatility
If archives are distributed over multiple volumes, then storage flexibility is improved, but password changes become even more time-consuming as all volumes must be processed
Solution Approach 1:
The system implements a universal key derivation mechanism that works across multiple volumes through standardized metadata. The same key derivation function and metadata structure are used regardless of whether data is on one volume or multiple volumes, allowing consistent and efficient password changes across the entire distributed archive system without requiring volume-specific processing.
Data Source
AI summary
An apparatus and a method for validating encrypted archive keys is described. In one embodiment, a passphrase is enciphered. An archive key used to encipher an archive is enciphered with the enciphered passphrase. A first enciphered block is computed by enciphering a random block with the archive key. A second enciphered block is computed by enciphering the same random block with a Message Authentication Code (MAC) key. The MAC key is derived from the archive key and the passphrase. The validity of keys is determined by comparing the decrypted first block with the decrypted second block.