Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a personal project in mind in which I plan to use cryptography in order to let the users be confident in the fact that, even if all data get's stolen, it would be virtually impossible to crack in the next few decades.

I would like some advice on the way I planned it until now:

All data resides in two key/value stores:

Store 1 - contains messages:

  • key : msg_id (numerical)
  • value : AES encrypted message with random key K1.

Store 2 - links users to messages:

  • key : hash H1 of (user identification + password + X)
  • value : AES encrypted data containing the msg_id and key K1, encrypted with key K2 (identification + password + salt/padding)

( X increments from 1 to N, per message linked to user. I use this to create more noise, should there be an attack, and to differentiate the hash H1 with key K2).

Without any regard to the way it should work (which is quite specific): is the data contained in the two stores safe even if an attacker knows their architecture and has access to the application's source code ? They may know some user id's, but not their password.

BTW: I'm quite new to cryptography. I'm reading through the basic materials (applied cryptography by Bruce Schneier, for one), so please be indulgent.

share|improve this question
Could you describe the purpose of the messaging system? For example, is it for me to send a message to myself, or is it for me to send a message to someone else. If it is the latter, I don't see how that "someone else" could decrypt the message. – mikeazo Apr 18 '12 at 15:49
Store 2's keys and K2s would be too easy to calculate from the pass-phrase. See – Ricky Demer Apr 18 '12 at 23:49
Thanks for the comments, I'm rethinking the system more thoroughly for the moment. Rest assured, I'm not implementing anything for the time being ;) – Berzemus Apr 26 '12 at 10:00
up vote 2 down vote accepted

First, as a bit of general advice: Designing a secure cryptographic system is hard. Experts with decades of experience still make mistakes. Depending on your intended audience, you may be better served by looking for an established system that meets your needs rather than trying to design an implement something from scratch.

To answer your specific question above, I would suggest that the keys of store 2 are one weak point. With a list of these keys, and one or more user IDs known, it's straightforward to implement a dictionary attack to try and discover the associated passwords. (X does nothing to help protect the passwords, because it is not random.)

Passwords are notoriously a weak point of most systems in use today, thus you might contend that this is unavoidable, but you should still strive to avoid making it easy to do an offline dictionary attack.

share|improve this answer
Good point. But what if pass-phrases are enforced instead of passwords ? Wouldn't dictionary or brute-force attacks become too difficult then ? – Berzemus Apr 18 '12 at 20:09
@Berzemus: use some slow password hashing algorithm like Bcrypt to generate the keys from the passwords. – Paŭlo Ebermann Oct 2 '12 at 17:01
This answer would be more useful if you named specific systems that met those needs. Are you perhaps thinking of Freenet, or what? – David Cary Oct 2 '12 at 17:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.