Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

AES uses a key that is at most 256 bit.

I assume AESCrypt uses AES.

When a file is encrypted with AEScrypt, there is no limit to the length of the password.

What is the relation between the AESCrypt password and the key size of the underlying AES encryption?

share|improve this question
    
Based on this answer to a related question, it appears to be a reduced version of PBKDF2. As @ThomasPornin notes, this is not good; using a custom password-processing technique is a strong warning indicator (plain PBKDF2, for instance, would be perfectly acceptable since it has survived lengthy cryptographic scrutiny). –  Stephen Touset Jan 7 at 22:53
    
thanks Stephen. The related post is indeed answering my question: The AES encryption key is derived from the IV and the password by concatenating the two into a buffer which is then hashed 8192 times. The IV is acting as the "salt" for the hash. –  Assaf Shomer Jan 9 at 11:02
    
@StephenTouset Most ad-hoc password hashing schemes will have the same security as PBKDF2. Possibly even a bit more, since PBKDF2 invites low performance implementations. Specification wise PBKDF2 is pretty silly as well. –  CodesInChaos Jan 9 at 13:57
    
@CodesInChaos I agree with you on that. However, I also believe that it's a warning indication that the developers may have a tendency to "roll their own" for more than just password hashing. –  Stephen Touset Jan 9 at 17:58
add comment

2 Answers

I assume AESCrypt uses AES.

AEScrypt uses AES-256 in CBC mode. However, the program also uses SHA-256.

When a file is encrypted with AEScrypt, there is no limit to the length of the password.

The Linux implementation of AEScrypt limits password to 1024 characters. This means: it is practically unlimited, and you can use even very long passphrases. (The other versions of the program may vary in password length.)

What is the relation between the AESCrypt password and the key size of the underlying AES encryption?

Nothing. The AES key will be always 256 bits. However, if the password has insufficient entropy, the AES key although 256-bits long will not be secure against password brute-forcing attempts.

Password security

The program uses salted (128 bit IV) SHA-256 to derive key to use from password. The hash is invoked 8192 times, which is quite small. This means that possible attackers are able to try brute-forcing quite a w few hundred thousand or a million passwords per second. Thus, passwords containing e.g. little entropy or just few dictionary words are likely broken with ease.

It is very likely that password is the weakest link. To have as much entropy as full AES-256 key, passphrase needs to contain around 25 words. Password would need to be somewhere around 50-100 characters. Generally, nobody often uses that long passwords (AEScrypt would allow it, see above).

Key use

The result of key derivation is a key that is used for AES (encryption/decryption) and HMAC-SHA256 (protect file integrity/prevent modifications). The same key is used for both purposes.

Issues (detected when analyzing code)

  • Ad-hoc salted hashing would be better replaced with scrypt. I'd like PBKDF2 more than hash, because it is well studied construct although it gives little other benefits.
  • It is not recommended to use one key for different purposes. (It does not seem to vulnerable, though.)
  • The AES implementation used is not side-channel free.
  • The /dev/urandom is used much more than is minimum needed. (Works badly together with any software that uses /dev/random.)

None of these appears very bad (i.e. easy to exploit in usual usage).

share|improve this answer
add comment

Based on http://security.stackexchange.com/a/7932/12407

The AES encryption key is derived from the IV and the password by concatenating the two into a buffer which is then hashed 8192 times. The IV is acting as the "salt" for the hash.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.