Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I am setting up a Python program to encipher messages on the following basis:

-from my password, generate 32-byte key from SHA256(password)

-generate a 16-byte IV from a PRNG

-measure the length of the plaintext and express as 2 bytes (my plaintext will be shorter than 2^16 characters)

-pad the plaintext to be a multiple of 16 bytes

-make an instance of the encryptor = AES.new(key, CBC, IV)

-generate ciphertext = encryptor.encrypt(plaintext)

-make string of concatenated length pt before padding||IV||ciphertext and send to recipient

-also send to recipient the tag from HMAC(key,concatenated string)

My question is whether for security I should use a different key for the AES encryption and for the HMAC tagging?

This seems to me unnecessary, in the sense that with a strong password the chance of finding the key by reverse engineering either the ciphertext or the tag is negligible. Or is it?

share|improve this question

1 Answer 1

I'd advise you to use a library with a higher level API, such as Keyczar.

That being said:

  • Don't generate the key using SHA-256. Use a password hash function such as bcrypt or scrypt.
  • Yes, you must use different keys. For example, you can use the password hash function to generate 64 bytes of key material, and use the first 32-byte half for encryption and the second half for authentication.
  • Make sure the IV comes from a good randomness source (e.g. /dev/urandom)
  • Make sure your padding is correct. Or simply use CTR which does not require padding.
share|improve this answer
    
Thank you for these inputs. Could you very kindly explain why you recommend a higher level API and also why not use SHA-256 to generate the key? –  user2256790 Apr 24 at 14:42
    
Sorry for this unintended duplication ---Thank you for these inputs. Could you very kindly explain why you recommend a higher level API and also why not use SHA-256 to generate the key? –  user2256790 Apr 24 at 14:44
    
In a higher level API is easier to avoid mistakes, since they take care of the low-level stuff. The reason for not using SHA-256 is in the link provided in the answer, but in short: it's too fast, which makes brute force attacks faster. Furthermore its output is limited to 256 bits and you may need more for generating both keys. –  Conrado PLG Apr 24 at 15:05
    
Got it. Thank you. –  user2256790 Apr 24 at 15:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.