I am working on a library (using standard primitives: AES256 CTR; HMAC with SHA256; PBKDF2 with SHA256, 128 bit salt, and 10000 rounds) to encrypt and decrypt data, given a password.
The encrypted data includes a header with version information and an HMAC (the header is included in the HMAC).
I am worried about exactly how I should check/use HMAC and version:
In a future release (with a new version number), the HMAC algorithm or parammeters may have changed. So I need to check version first and abort if the version is newer than the current code. But that means that if someone maliciously alters the version then they can "trick" the code into aborting (and likely issuing a warning to the user saying that they should update their software).
Alternatively, in the future, if the version is within acceptable range, then I need to use that to select the HMAC. That will then validate the version. But it seems like it could lead to an attack that allows an older, broken HMAC to be abused in some way.
Is there some standard way around these issues? Or are they not considered important? Or do I simply need to wait until I have more specifics (for the second case). Is there anything else I should know? Should I extend the API now to include a flag that controls backwards compatibility? Since the API is meant to be very simple that needs a default - what should it be?
I realise that I am not the best person in the world to be doing this work, but no similar library appears to exist for Python 3 and so far I have been lucky enough to find useful support from others (eg on HN; also note that I am not writing any algorithmic code - everything is delegated to pycrypto). Thanks.