Elaborate file names about qubes-incremental-backup-poc

[v6ak]

I will probably use some punk solution like the following:

IV = hmac_sha256(key_iv_derivation, vm_name).take(16)
CT = aes_256_gcm(key_encrypt, pad(128, vm_name))
filename = base64(IV||CT)

Properties:

• Obscures length of VM name. (As of Qubes 3.2, VM name can have at most 31 characters.)
• Deterministic – IVs are deterministically generated.
• Reversible – one can decrypt it with proper key.
• Authenticated.
• Hopefully secure.
• Probably pretty non-standard. But I am OK with such a risk for hiding not-so-sensitive data in MVP.

[v6ak]

Changes:

• Will use base32 instead of base64 in order to support case-insensitive storages.
• Probably smaller padding in order to maintain filenames at most 255.
• CTR+HMAC instead of GCM, because I was not able to find a suitable implementation of GCM.

https://pthree.org/2016/02/27/manual-authenticated-file-encryption-with-openssl/#comment-269294