To what extent is security compromised by cloud providers' file version history?

Knowledge Base Security
1

I’m intending to use Cryptomator with Dropbox. As far as I understand it, one decrypted file in a vault always corresponds, throughout its lifetime, to the same encrypted file that gets uploaded to, and updated via, Dropbox. If and when a particular file changes, Dropbox will keep track of a version history of the encrypted version of that file, as it does with all files.

So, assuming the plaintext of that file changes repeatedly (imagine it’s a plain text contact list that I’m updating every couple of days), Dropbox.com now possesses multiple ciphertexts (arbitrarily different from each other) corresponding to multiple plaintexts that can be presumed to have overlapping content. If an attacker were to get hold of the version history of a file, this would presumably make it a lot easier to for them to break many forms of encryption (or so we learn from watching The Imitation Game). Has anybody tried to get an idea of whether and how much this would weaken Cryptomator security in typical cases?

2

Hi Jez,
To answer your question, we need to understand a little bit more about the encryption algorithm used by Cryptomator, which is 256 bit AES. There is much information on the web that you can find about this algorithm, as it is one of the most commonly used encryption algorithms, due to its speed and security. Having lots of encrypted content - even if the corresponding plaintext has overlap - is not enough to crack AES. Also if the attacker has access to a great amount of ciphertext and the corresponding plaintexts, it would not be possible to reverse engineer the AES key.
I hope that this answers your question.
Cheers

2 Likes