I am using one tool which encrypts files before these are synced to the cloud. I just opened the encrypted file to see how it looks. Here are the top five lines: I am a bit surprised that algorithm name, key size, initialization vector and some other parameters are appearing in plain text (which seems to be the header). I contacted the company and they say even when these things are open, attacker cannot break the cipher. My argument is why this hint to be provided to the attacker. Awaiting expert comments.
Attempts to hide or obfuscate this information is effort badly spent (called security by obscurity, doesn't work). In order to decrypt, you (the program) needs to know all those parameters, and even if algo etc not provided, a hacker can easily go through the limited number of options. The IV needs to be plain because that is to prevent similar texts having the same encryption key. The good encryption algorithms all have this characteristic, that they are strong even though you know these parameters.
deBoetie is correct. Even with Linux LUKS headers, which are considered very reliable and strong, that information can easily be seen and read using simple tools. There are no significant concerns to your security, but let me say I do understand what you are saying. As a follow up if it really bugs you, one option would be dmcrypt. It is not for the faint of heart but it can provide for headerless encryption. It comes with Pro's and Con's so give it a read if you feel its worth pursuing. My useage of dmcrypt was not for security but rather privacy ----------------------- > an adversary could not be conclusive that my media wasn't wiped as opposed to encrypted. In the end my archives are hidden in nested encrypted volumes, where a shell volume is my "$5.00 wrench protector". That is a better solution than a headerless encryption model. They are both very secure. You decide.
