2

I have used GnuPG to encrypt some long-term backups, but I am concerned whether over time data corruption might make it impossible to recover the archives.

Can you decrypt partially corrupted OpenPGP files?

5
  • A file being encrypted has no sway on a the ability for a file to become corrupt on a given storage device. You should use storage solutions that allow you to recover from data corruption, since decrypting a corrupt file, just results in an unecrypted corrupted file.
    – Ramhound
    May 26, 2016 at 12:50
  • Thanks for your comment, I struggle with english sometimes and the title wasn't clear. What I meant to ask was whether a partially corrupted encrypted file with GPG can be decrypted at all?
    – chris.fy
    May 26, 2016 at 12:54
  • I understood your question, and I choose to address it, to point out the fact even if you do decrypt the file you still have a corrupted file. What problem are you trying to solve?
    – Ramhound
    May 26, 2016 at 13:25
  • As I understand after 10+ years data will start to have small amounts of data corruption. My intended question was whether these tiny amounts of data corruption will make the file completely unable to be decrypted.
    – chris.fy
    May 26, 2016 at 15:50
  • Who says after 10 years you will encounter data corruption? If the file is store on the RAID, and the RAID never fails, depending what type of RAID data corruption won't happen. There are solutions for bit rot, most modern file systems deal with it nativley, allowing you to detect and even recover from a checksum error, there are even PAR files that can restore the missing blocks if created before the corruption happens. You just then have to worry about the data corruption on the PAR files themselfs.
    – Ramhound
    May 26, 2016 at 15:57

1 Answer 1

5

Whether a crypto system is resilient to partial corruption (this is called self-synchronising cipher) or not depends on the mode of operation.

OpenPGP (the standard GnuPG implements) relies on the cipher feedback mode CFB with a shift register making the cipher mode self-synchronizing. A corrupted block in the crypto text will result in two blocks being affected in the plain text: the corrupted bits in the block directly affected by the corruption, and the next block being completely garbled. After this, the cipher synchronized again and returns the correct plain text.

To have GnuPG ignore detected corruption, apply the --ignore-mdc-error option. But be aware, such a corruption could also be by intend of an attacker, and disabling this check prevents detection of such issues (from man gpg):

This option changes a MDC integrity protection failure into a warning. This can be useful if a message is partially corrupt, but it is necessary to get as much data as possible out of the corrupt message. However, be aware that a MDC protection failure may also mean that the message was tampered with intentionally by an attacker.

But be aware that usually compression is applied before encryption (as compression is much cheaper/faster than encryption, and also can prevent a rather esoteric attack on OpenPGP): depending on the compression algorithm used (internal to OpenPGP or external like JPEG-compressed images), additional corruptions might occur.

To generally prevent random corruptions over time, have a backup periodically "scrub" both the original and backup copy. Modern file systems like ZFS, BTRFS and Microsoft's ReFS implement such a scrub-feature on file system level, and all proper Backup software also does.

3
  • 1
    Nice answer, +1. But what is a scrub? May 26, 2016 at 14:08
  • An advanced integrity check, also verifying file checksums stored in the file system. To quote Oracle: "The simplest way to check data integrity is to initiate an explicit scrubbing of all data within the pool. This operation traverses all the data in the pool once and verifies that all blocks can be read." If the file system has RAID with redundancy enabled, the file system can also decide which copy is the correct one.
    – Jens Erat
    May 26, 2016 at 14:51
  • Thanks for the fantastic answer Jens Erat. I didn't even think about compression.
    – chris.fy
    May 27, 2016 at 11:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .