True, but I don't think that's a concern for most people.
What are the practical implications? The only one I can think of is if someone were trying to prove in court that you had a particular file.
A related question I've been wondering about is whether a hash or key+ciphertext are considered proof of possession of the original file. In theory an infinite number of files have the same hash, and the ciphertext could have been produced using a different key (or it could just be random data). In practice it's extremely unlikely (for sufficiently secure hash and encryption functions). What are the laws'/courts' views on cryptography?
Doesn't the theory of infinite collisions existing, require that you are nit restricting the file size? The combination of "the hashes match" and the file sizes are roughly the same would seem to go beyond a reasonable doubt.
Not really. Let's use for example a 256 bit hash and a 1KB file. That means you have about 2 ^ (1024 * 8 - 256) collisions that are the exact right size. Close enough to infinite for any file that's at least a hundred bytes. The more pressing concern is how hard it is to fake a particular hash.
>True, but I don't think that's a concern for most people.
But that is the kind of thinking that lead to the whole issue with Dropbox in the first place. Its deceptively "secure" to any user who can't analyze the implementation implications themselves.
Well, yes, that's the point of the deduplication. If you already have the same exact file, in its entirety, you can check if it's in the system or not.
Comments
tzs's scheme proposes encrypting files with the hash of their contents (see http://news.ycombinator.com/item?id=2461713).
That's not semantically secure. Anyone can distinguish whether a particular plaintext produced a given ciphertext.
True, but I don't think that's a concern for most people.
What are the practical implications? The only one I can think of is if someone were trying to prove in court that you had a particular file.
A related question I've been wondering about is whether a hash or key+ciphertext are considered proof of possession of the original file. In theory an infinite number of files have the same hash, and the ciphertext could have been produced using a different key (or it could just be random data). In practice it's extremely unlikely (for sufficiently secure hash and encryption functions). What are the laws'/courts' views on cryptography?
Doesn't the theory of infinite collisions existing, require that you are nit restricting the file size? The combination of "the hashes match" and the file sizes are roughly the same would seem to go beyond a reasonable doubt.
Not really. Let's use for example a 256 bit hash and a 1KB file. That means you have about 2 ^ (1024 * 8 - 256) collisions that are the exact right size. Close enough to infinite for any file that's at least a hundred bytes. The more pressing concern is how hard it is to fake a particular hash.
However, Igor's statement does hold true for (some) hashes that are at least as long as the maximum file size :P
Thanks for explaining. +1.
>True, but I don't think that's a concern for most people.
But that is the kind of thinking that lead to the whole issue with Dropbox in the first place. Its deceptively "secure" to any user who can't analyze the implementation implications themselves.
Well, yes, that's the point of the deduplication. If you already have the same exact file, in its entirety, you can check if it's in the system or not.