{
  "slug": "convergent-encryption",
  "term": "Convergent encryption",
  "aliases": [
    "content-hash keying"
  ],
  "definition": "Convergent encryption derives an encryption key from content so that matching plaintext can produce matching data ciphertext for deduplication.",
  "note": "Farsite separates the shared content ciphertext from per-reader wrapping of its content-derived key; equality is exposed intentionally. [farsite2002] Message-locked encryption generalizes this family, with separate privacy and tag-consistency definitions. [mle2013] Do not equate a content hash with an independently secret key. [hesela-dedup-security]",
  "status": "research",
  "advantages": [],
  "limitations": [],
  "related": [
    "deduplication",
    "cryptographic-hash",
    "authenticated-encryption",
    "oblivious-prf",
    "deduplication-side-channel"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "farsite2002",
      "title": "Douceur, Adya, Bolosky, Simon and Theimer. Reclaiming Space from Duplicate Files in a Serverless Distributed File System. ICDCS 2002, section 3.",
      "url": "https://www.microsoft.com/en-us/research/wp-content/uploads/2002/01/ICDCS2002.pdf",
      "accessed": "2026-10-18"
    },
    {
      "id": "mle2013",
      "title": "Bellare, Keelveedhi and Ristenpart. Message-Locked Encryption and Secure Deduplication. EUROCRYPT 2013; full-version record, ePrint 2012/631.",
      "url": "https://eprint.iacr.org/2012/631",
      "accessed": "2026-10-18"
    },
    {
      "id": "hesela-dedup-security",
      "title": "Hesela: Encrypted deduplication: who can test a file guess?",
      "url": "https://hesela.com/analyses/encrypted-deduplication-trust-boundaries/",
      "accessed": "2026-10-18"
    }
  ],
  "updated": "2026-10-18"
}