Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have a simple problem: I have a set of users' ECDSA key pairs, and say I want to encrypt them with a simple algorithm. I have access to one variable that uniquely identifies the user, so I hash it with a SHA-2 algorithm and have a string of bytes longer than each of the keys.

Is it safe to XOR a key pair, or XORing both of the keys together will make it easier to decode the original value?

What if I hash the entire key chain, does that make it much easier to get the data?

share|improve this question
1  
Is your "variable that uniquely identifies the user" secret (i.e. only known to this user)? Only then it makes sense to use this to create an encryption key for this user. –  Paŭlo Ebermann Sep 27 '11 at 14:34
    
Yes, like a login and password together, so it is unique to the user and only the user can generate the whole variable. –  ThePiachu Sep 27 '11 at 16:11
add comment

1 Answer 1

up vote 5 down vote accepted

What you are proposing in effect means that you use a not-really-random one-time-pad, which is used twice (i.e. a two-times-pad). This is not secure.

  1. Using a single hash to generate a key from a password is a bad idea - especially if the password is short, it is easy to brute-force it (i.e. try lots of passwords).

  2. Using the simple XOR cipher to encrypt a ECDSA key pair, one half of which is public anyway, means that half your key is directly derive-able from the encrypted key pair. (This helps with the brute-forcing in step 1.)

  3. Using a one-time-pad twice means that the attacker can derive $x_1 \oplus x_2$ (i.e. the XOR of the two private keys). I don't know of any way to come from this to $x_1$ and $x_2$ (given also the public keys $g^{x_1}$ and $g^{x_2}$), but I would not wonder if someone would find a way to do this easier than trying all $x_1$.

Instead, use established algorithms:

  • Use an established key derivation function (Bcrypt, Scrypt, PBKDF2) with an appropriate work factor to derive the key from a password.
  • Use a secure cipher algorithm (a block or stream cipher) in a secure mode instead of XORing.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.