If you suspected a file might be intercepted, an archive with a password would at least make the contents difficult to recover, but certainly not impossible. It occurred to me that most methods used to crack a passworded archive would quit early if a password worked, so one or more dummy weak passwords could be used to obscure the real content. Of course obscurity shouldn't be the first line of defense, but it can't hurt. Can this be done?

  • you can always put an encrypted archive into an encrypted archive, together with some inappropriate images. – Bananguin Jan 22 '17 at 18:11

in theory it can, in practice I doubt it. In essence, you would need to craft a message that would have a double hash-collision, one for each password.

Suppose you can craft a meaningful msg that would decrypt using password P1 into PlainText1 and using strong P2 into PT2.

The problem - crafting PT1 and PT2 such that P1(PT1) == P2(PT2) == E.
Edit: @Banaguin raises some good points - if P1 == PT1 and P2 == PT2 you can craft such an equality. The problem is that P1 should be a "weak/trivial" password, while P2 should be a "strong" password.
Using P1 == PT1 and P2 == PT2 would not scale for large messages - a 1k text message would become non-trivial to decrypt even for the "weak" password and with lesser probability it will be chosen over the "strong" password.
The second problem with this approach is that the "strong" password should be "strong" - if it is the message itself, there is no guarantee that it will be strong, unlike properly crafted passwords.

| improve this answer | |
  • 1
    Designing such a message is easy. Let P1 == PT1 and P2 == PT2 then E could be the semantic equivalent of identity. Also, good encryption isn't one-way, not even in theory. If it was, it would be irreversible and it would be impossible to extract the original message from the cypher, thus totally failing its purpose. Further, creating such collisions is not even hard. The hard/unsolved/impossible(?) part is finding a PT1 such that a potential attacker cannot tell that there is a PT2 hidden in this cypher. – Bananguin Jan 22 '17 at 18:37

What you describe is not possible with the common archivers. However, steganography was invented pretty much for that purpose.

| improve this answer | |

You could do this with a TrueCrypt container with a hidden container in it?

| improve this answer | |
  • 1
    Welcome to Unix.stackexchange! I recommend you take the tour. When giving an answer it is preferable to give some explanation as to WHY your answer is the answer. – Stephen Rauch Jan 22 '17 at 19:17
  • This might be a good strategy for obscuring files in local storage, but how would you transmit or remotely store these files? Nest it in a vm image/container? – John P Jan 22 '17 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.