Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

It's my first time using stackexchange!

So, I am doing a password manager in Java.

But now I am VERY confused because of the encryption. There will be the program login, where the user types its password, and it compares to a SHA512 hash. If it matches, the user logs in, if it doesn’t, then the user doesn’t login. I think there is no problem at this point.

And then, I am using AES to encrypt the user saved passwords. The user logs in, and then clicks on an "decrypt" button to decrypt his saved passwords.

My problem is, how am i going to do this? Because I thought for a bit, and... the decryption key must be saved somewhere. But it cant be in plain text... PLUS it needs to be exactly 16 chars long.

I created a thread on Reddit - http://www.reddit.com/r/java/comments/2awvjt/storing_encryption_key/

They give me several options, but none seems to be what I want. Why? Let's see 3 options a user gave me:

  1. Store the encryption key. Not secure in the least

  2. User has a password that is used to encrypt the encryption key - Pretty secure and usable

  3. User has a private encryption key that you don't store. Very secure, very usable.

Well these are my opinions:

  1. Obviously I’m not going to use that one, since the key will be stored in plaintext.

  2. Well, I can hash the encryption key! But the hash must be stored somewhere! And its the hashed encryption key that’s going to be used to decrypt the user passwords... so I can use 16 chars of it. It is not user friendly if the user needs to set and remember a 16 char password! So i guess this is NOT secure

  3. If I don’t store it, how am I going to decrypt it?

So, what can you suggest me?

share|improve this question
    
If you are very confused about encryption then a password manager may not be the best thing to program, unless it is as a learning experience. –  owlstead Jul 18 at 0:49
1  
Is this a stand alone app, or a client server app? –  mikeazo Jul 18 at 1:39
    
Owlstead - It is a learning experience. Mikeazo - It is a stand alone app. –  Plasticoo Jul 18 at 12:47

2 Answers 2

up vote 2 down vote accepted

First, using only a single SHA512 to hash the password is not enough. You should use something like bcrypt with a long salt to store user password "hashes". A simple SHA512 can be attacked quite powerful with a dictionary attack, just trying millions of possible passwords and calculating the SHA512 hash for that until one matches.

Concerning the encryption of other users passwords. Best would probably be to use a KDF (key derivation function) like PBKDF2 or SCrypt to derive a key (or keys) from that. These can be used to en/decrypt the stored user passwords.

But do not just apply e.g. AES directly to these passwords. Put the passwords in a suitable format e.g. XML or JSON and encrypt the serialized structure using a good AEAD scheme like GCM etc. Or use CBC but attach a MAC (HMAC or CMAC) to it. But always Encrypt-then-MAC !

share|improve this answer
    
Whoa, seems more complex than I thought! Thanks for the tips! But about the PBKDF2 or SCrypt, it does need a key to get the plain text password right? If so, how can i store that key? –  Plasticoo Jul 17 at 22:12
    
I hope I did understand your question. First you need a password based login (hash the password with bcrypt and compare it to the stored "hash"). Additionally your would like to store some user passwords (like a kind of password safe). The later should be encrypted. For that you derive a key from the users password each time the user wants to access his password safe. PBKDF2 takes a password and a salt to generate a key for en/decrypting the password safe. These are two different things: login and en/decrypting the "password safe". Does it help ? –  Thor Jul 17 at 22:31
    
Yes! Im sorry, english is not my native language. I guess i got no problems at all with the login part. I think i need to go see how PBKDF2 works and how to implement it in Java. Thank you a lot for the help, and im sorry for anything! –  Plasticoo Jul 17 at 22:50
    
Another idea, if your password manager only works locally for a single user you can skip the login part. If the entered password successfully decrypts the password store it would be sufficient for authentication. You can use Bouncy Castle, it already provides PBKDF2, as far as I know. –  Thor Jul 17 at 22:59
    
It will work locally, for a single user. For now. But are you sure that skipping the login part is better? Isnt a "two-way auth" better? –  Plasticoo Jul 17 at 23:39

I second the suggestion of a strong password based KDF, e.g. PBKDF2 or scrypt, which you use to derive the encryption key(s) from the user's password. Additionally, use authenticated encryption (e.g. either AES GCM or AES CTR + HMAC).

If you can't open the encryption using the key derived from the password they enter, you know the password was wrong. No need for a separate login step.

There is one situation where you might want to use a more complicated setup. That's if you need to upload the data somewhere. In that case you could generate a random data encryption key, which you in turn encrypt using the password-derived key. That way the encrypted data alone doesn't allow a password guessing attack. However, in that case losing the encrypted keyfile will lead to loss of encrypted data as well.

So, what can you suggest me?

The final suggestion I have is to not use this for any crucial data, like important passwords, unless you are very sure you get everything correct. There are existing programs for that, which are (hopefully) written by programmers knowledgeable about cryptography.

Of course, as a learning experience it's a great problem to try to solve.

share|improve this answer
    
Thanks. Ill try to implement the most secure things i can. I will follow your advice, together with Thor's advice. –  Plasticoo Jul 18 at 12:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.