-1

I tried running travis encrypt "some secret string" multiple times in the same repository, and it returned different encrypted strings each time. Does Travis use probabilistic encryption? If not, what am I doing wrong?

Edit: if there is an IV, how is this IV agreed upon by my local travis cli and the Travis servers? Can I view or change it?

oink
  • 1,443
  • 2
  • 14
  • 23
  • 1
    As I stated in the answer the IV can and generally is prepended to the encrypted data so it is available for decryption. No prior agreement is needed other than the encryption key of course. – zaph Jul 10 '17 at 18:44
  • Consider accepting answers that are helpful. By accepting a answer you are indicating to future readers that it is a correct answer. – zaph Jul 12 '17 at 14:25

1 Answers1

1

See Probabilistic Encryption WRT block ciphers .

An example of different results encryption the same data in a block based encryption algorithm such as AES and CBC mode with a random IV. The IV can be prefixed to the encrypted data and the encrypted data will be different because there is a different IV each time the same data is encrypted, this is a common and good standard practice, the IV does not need to be secret.

If the IV can be prepended to the encrypted data it is available for decryption, no prior agreement ios required.

Here is CBC mode, notice that the IV is xor'ed with the first block of data and each subsequent block is xored with the previous encrypted block. Thus the IV affects every block of the encrypted data.

This is done so that two identical messages will not have the same encrypted data. Consider the case where one of two messages is sent on an on-going basis: "0" or "1" where 0 meant sell and 1 meant buy. If the encryption were the same each time even though the message themselves could not be determined the two states could be determined and which one it was.

Travis-ci uses aes-256-cbc for it's Automated Encryption.

There are other encryption options such as asymmetric encryption such as RSA that can use random padding.

zaph
  • 111,848
  • 21
  • 189
  • 228
  • I don't think your answer answers the question. What about travis-ci? – Artjom B. Jul 10 '17 at 18:08
  • Agree, the answer does directly address travis-ci. It provides a solution to the different encryptions for the same data that is also common usage. If the OP would provide a couple samples that would help, or I could dig-into travis-ci and find that it does use aes-256-cbc for Automated Encryption. – zaph Jul 10 '17 at 19:28
  • Ah, okay. I don't seem to understand IVs, I'll read more about it. – oink Jul 18 '17 at 17:27