Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to encrypt a file, distribute it over an insecure channel, and decrypt it later. Using a symmetric-key algorithm. Here's what I intend to do:

Get a password P from the user. Generate a 16-byte random salt S. Derive a key K1 = PBKDF2(HMAC-SHA1, P, S, iter=2000, bits=256). Divide the data into blocks of 1024 bytes each. For each block, generate a random 16-byte IV. Encrypt each block with AES-256 with key K1 and this IV. For each block, calculate D = HMAC-SHA2 of the concatenation of IV and encrypted data. For each block, write out the IV, the ciphertext and D.

Now I need to store and distribute the salt too. For this, I derive key K2 = 1000 iterations of SHA2("somefixedtext" + P) and IV2 = 500 iterations of SHA2("someotherfixedtext" + P). The salt is then encrypted with AES-256 with key=K2, IV=IV2 and stored alongside the ciphertext.

OK, so is this secure enough?

share|improve this question
Your salt encryption step doesn't make much sense. Why not just include the plain salt? – CodesInChaos Aug 29 '12 at 17:06
Were the salt known to the attacker, isn't it as good as not using a salt? Couldn't he try to use the salt + dictionary words to derive K1 himself? – file-encrypter-noob Aug 29 '12 at 17:15
@file: The purpose of the salt isn't to add more unknowns, it's primarily to a) prevent the password+salt combo from being located in a pre-computed dictionary, and b) to allow the same password to be derived to different keys if needed. The only thing we must keep from the attacker is the password. – B-Con Aug 29 '12 at 18:09

First off, you are still missing some information. What encryption mode will you be using? What key are you using for the HMAC?

That said, my answer is no. This isn't a good way. The reason being is that unless you are a professional cryptographer, you shouldn't design your own cryptographic protocols/methods. There are too many ways to introduce vulnerabilities in both the design and the implementation that it is risky. Stick with published standards that the cryptographic community has been able to look at and analyze. You can encrypt files using PGP or the open source implementation GnuPG.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.