Re: security of re-encryption

On 8 Nov 2022 03:40 +0100, from [email protected] (Philippe Cerfon):
> I mean if the payload data stays mostly or exactly the same and an
> attacker would be able to make an image (of the encrypted volume)
> before and after [re-encryption], could that help for statistical attacks in order to
> get the key?

Personally, while I am certainly open to being proved wrong in this, I
doubt it. That would imply that, with two unrelated keys both selected
at random, something in the underlying cipher (most likely AES) causes
the two ciphertexts of an identical plaintext to have correlations
that would provide an adversary with a significant advantage in
deriving either key. (Even just a few bits' work factor worth would
very likely count as significant here.)

Even if it was mode-specific (for example, applies only to AES-XTS, or
does not apply to any currently defined chaining modes), that would be
a _major_ break of any encryption algorithm, let alone of AES, and
something I would expect to be presented at a major cryptography
conference or at the very least in a field-relevant journal; certainly
not in a post on a mailing list.

It would also potentially have implications _far_ beyond full-disk
encryption. Consider just that the first several bytes of the HTTP
request portion of a HTTPS transaction are not just guessable, but can
pretty much be considered to be _known_ since they are essentially
dictated by the HTTP standard.

-- 
🪶 Michael Kjörling                  🏡 https://michael.kjorling.se
“Remember when, on the Internet, nobody cared that you were a dog?”