convergent-encryption · research · also content-hash keying

Convergent encryption

Convergent encryption derives an encryption key from content so that matching plaintext can produce matching data ciphertext for deduplication.

Related Observatory article: Convergent encryption on hesela.com

Farsite separates the shared content ciphertext from per-reader wrapping of its content-derived key; equality is exposed intentionally. [1] Message-locked encryption generalizes this family, with separate privacy and tag-consistency definitions. [2] Do not equate a content hash with an independently secret key. [3]

Relations

related

deduplication, cryptographic-hash, authenticated-encryption, oblivious-prf, deduplication-side-channel

Citations

1. Douceur, Adya, Bolosky, Simon and Theimer. Reclaiming Space from Duplicate Files in a Serverless Distributed File System. ICDCS 2002, section 3. (accessed 2026-10-18)
2. Bellare, Keelveedhi and Ristenpart. Message-Locked Encryption and Secure Deduplication. EUROCRYPT 2013; full-version record, ePrint 2012/631. (accessed 2026-10-18)
3. Hesela: Encrypted deduplication: who can test a file guess? (accessed 2026-10-18)

JSON: /data/terms/convergent-encryption.json