Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kind of keys: RSA public/private, AES and a user key derived from a phrase.

  • encrypt the file with AES (I use OFB mode).
  • encrypt the AES key with RSA.
  • write the encrypted AES key to the file header
  • generate a user key
  • with the user key I encrypt the RSA private key and the IV too, then place them to a database file.
  • I also hash the original AES key and store it in the database

A database file structure looks like this:

size_t fileID;
byte rsaPrivateEncrypted[RSA_KEY_LEN];
byte aesIVEncrypted[AES_BLOCK_LEN];
byte aesKeyHash[HASH_LEN];

The key hash is used to validate the key, before decrypting the file check if the hashes are the same.

I've just read that there is still no implementation of a key wrap algorithm in Crypto++ library, so I use the method:

  • hash a user defined string (phrase) with MD5 (128 bit) - this will be the KEK
  • hash the hash again with MD5, this is the IV for KEK
  • encrypt the RSA private key and AES IV with them using AES

I've chosen MD5 because of its length fits AES' key/block size. (I know I could use the first n-bit of a longer hash too). I assume this way is pretty insecure, since I've read that there are special algorithm for this purpose (AESKW). What are the main drawbacks of this implementation? How can I make the key wrap/generation method more secure?

Also, in the wiki article, there is one more key:

  • FEK - KEK(RSA) - DPAPI - USER (hashed from PW).

What's the purpose of this key? As far as I understand, it is only used for decrypt the KEK. But the USER key could do this, since it is as secure as the USER key, no?

share|improve this question
1  
DPAPI has several purposes in Windows besides encrypting the RSA private key (to encrypt other secrets like WiFi passwords, and IE account passwords etc.); moreover the hash from the password is used only after thousands of iterations (and a random salt) provided by the DPAPI API. This slows down direct cracking attacks on the encrypted secret key, if the NTHash is not available, e.g. –  Henno Brandsma Mar 1 at 19:17
1  
And, as an afterthought, DPAPI has a mechanism to avoid re-encryption of secrets (like RSA private keys) protected by it, when a user changes its password. This is an added benefit. –  Henno Brandsma Mar 2 at 15:25
    
now it makes sense, thanks! –  PnD Mar 2 at 16:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.