Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from I have 3 kind of keys: RSA public/private, AES and a user key derived from a phrase.

  • encrypt the file with AES (I use OFB mode).
  • encrypt the AES key with RSA.
  • write the encrypted AES key to the file header
  • generate a user key
  • with the user key I encrypt the RSA private key and the IV too, then place them to a database file.
  • I also hash the original AES key and store it in the database

A database file structure looks like this:

size_t fileID;
byte rsaPrivateEncrypted[RSA_KEY_LEN];
byte aesIVEncrypted[AES_BLOCK_LEN];
byte aesKeyHash[HASH_LEN];

The key hash is used to validate the key, before decrypting the file check if the hashes are the same.

I've just read that there is still no implementation of a key wrap algorithm in Crypto++ library, so I use the method:

  • hash a user defined string (phrase) with MD5 (128 bit) - this will be the KEK
  • hash the hash again with MD5, this is the IV for KEK
  • encrypt the RSA private key and AES IV with them using AES

I've chosen MD5 because of its length fits AES' key/block size. (I know I could use the first n-bit of a longer hash too). I assume this way is pretty insecure, since I've read that there are special algorithm for this purpose (AESKW). What are the main drawbacks of this implementation? How can I make the key wrap/generation method more secure?

Also, in the wiki article, there is one more key:

  • FEK - KEK(RSA) - DPAPI - USER (hashed from PW).

What's the purpose of this key? As far as I understand, it is only used for decrypt the KEK. But the USER key could do this, since it is as secure as the USER key, no?

share|improve this question
DPAPI has several purposes in Windows besides encrypting the RSA private key (to encrypt other secrets like WiFi passwords, and IE account passwords etc.); moreover the hash from the password is used only after thousands of iterations (and a random salt) provided by the DPAPI API. This slows down direct cracking attacks on the encrypted secret key, if the NTHash is not available, e.g. – Henno Brandsma Mar 1 '14 at 19:17
And, as an afterthought, DPAPI has a mechanism to avoid re-encryption of secrets (like RSA private keys) protected by it, when a user changes its password. This is an added benefit. – Henno Brandsma Mar 2 '14 at 15:25
now it makes sense, thanks! – PnDChameleon Mar 2 '14 at 16:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.