Proposed version 2.0 - file streaming, version tagging

[paragonie-scott]

Satisfies the proposal outlined in #71

Supersedes #63
Closes #34
Closes #39

[sstok]

Trailing whitespace ;)

[sstok]

https://github.com/paragonie/php-encryption/blob/files/src/Crypto.php#L322
if (\in_array(self::CIPHER_METHOD, \openssl_get_cipher_methods()) === FALSE) { was this left unchanged intentionally?

[sstok]

Debug code

[paragonie-scott]

The latest test verifies that our nonce incrementing strategy is functioning correctly. Aside from the danger of birthday collisions, nonce collisions are mitigated.

Mitigating nonce reuse is nontrivial, since we're limited to 128 bits. I think we would first need to create a subkey for each file and store the random HKDF or PBKDF2 salt in the file data to make this impractical.

[paragonie-scott]

Since HKDF accepts a salt parameter, I added a random per-file salt to the file encrypted file header in addition to the IV.

Without the salt, the odds of a birthday collision after 2^64 files is approximately 50%. Depending on the file size, a nonce reuse becomes a real problem.

Using a random salt and a nonrandom nonce (e.g. all 0's) is virtually identical to the existing situation.

Using a random salt AND a random nonce raises our birthday resistance to require 2^128 files for a 50% chance of birthday collision. (This is effectively similar to a 256-bit nonce.)

[paragonie-scott]

The lastest commit should satisfy #93

[paragonie-scott]

Forgot about the runtime tests. Need new test vectors.

[defuse]

This is now CTR.

[paragonie-scott]

One thing that the File class doesn't have, but the Crypto class does, is the runtime tests. Would you prefer that they be run in that instance as well? (I'd wager your answer is, "Yes".)

[defuse]

Awesome!

[defuse]

$if doesn't get closed here.

[defuse]

I haven't looked too closely at the issues, but I'm going to merge this into a v2.0 branch so that it's easier to work with, and then open tickets for the issues I found.

[paragonie-scott]

Okay, sounds good to me. Need me to resubmit the PR?

[defuse]

@paragonie-scott: I just created the v2.0 branch, so feel free to submit PRs to it if you feel like fixing any of those things. :)

[defuse]

Hang on, I'm still trying to figure out how to push that branch to github.

[defuse]

There we go.

[paragonie-scott]

This has been merged in another branch.