# Am I insecurely implementing AES in Python? [closed]

My name is Pat, I'm a rising high school senior interested in Comp Sci. I've taken interest in cryptography following the NSA scandal. Since this is the first time I've ever implemented encryption my projects, I was wondering if I'm doing anything wrong!

import sys
import os

from Crypto.Cipher import AES
from Crypto.Protocol.KDF import PBKDF2
from Crypto import Random

import base64

class simpleAES(object):
def encrypt(self, data = '', key = '', key_size = 32, iterations = 1000):
# ENCRYPT

salt = Random.new().read(key_size) #salt the hash
pre_key = PBKDF2(key, salt, key_size, iterations)
derived_key = PBKDF2(key, pre_key)

cipher = AES.new(derived_key, AES.MODE_CFB, iv)

encodedtext = iv + cipher.encrypt(data)
encodedtext = base64.b64encode(encodedtext)

pre_key = base64.b64encode(pre_key)
derived_key = base64.b64encode(derived_key)
# END ENCRYPT

return encodedtext + "$" + pre_key def decrypt(self, data = '', key = ''): # DECRYPT pre_key = data.split('$')[1]
data = data.split('\$')[0]

data = base64.b64decode(data)
iv = '0000000000000000'
pre_key = base64.b64decode(pre_key)
decoded_key = PBKDF2(key, pre_key)

cipher = AES.new(decoded_key, AES.MODE_CFB, iv)

decodedtext = str(cipher.decrypt(data))[16:] #remove iv
# END DECRYPT

return decodedtext

aes = simpleAES()

enc = aes.encrypt("hello world this is some text i want to encrypt", "password1")
print enc
print



-

## closed as off-topic by rath, Gilles, Ilmari Karonen, mikeazo♦Sep 3 '13 at 14:45

• This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

@Alex Hardly... –  Thomas Aug 19 '13 at 3:26
I'm not sure if code review is within the scope of this site. I've raised the issue on the meta site. –  Gilles Aug 19 '13 at 9:23
You should be aware that @Alex's comment is patently untrue. –  Stephen Touset Aug 19 '13 at 19:15
Please note that you are not implementing AES in Python, but you are designing and implementing a custom protocol which uses AES as one of its components. –  Paŭlo Ebermann Aug 20 '13 at 7:18
This question appears to be off-topic because it is about reviewing Python sourcecode. Such questions have a home at Codereview.SE –  e-sushi Aug 28 '13 at 17:36

You're using encryption without authentication, which is a very common mistake.

But the most serious mistake you're making is: you are designing your own encryption method. That's rarely a good idea, unless you are an expert in cryptography. Typically you'll tend to overlook things that can cause security problems (use of encryption without authentication is just one common mistake).

May I make a different recommendation? If you want to learn about cryptography, I recommend you focus on reading textbooks and other sources on modern cryptography. A lot of people think they can "learn by doing" (e.g., try whipping up some code). However, cryptography isn't a great subject for "learning by doing", because an insecure scheme looks just like a secure scheme -- if you introduce some subtle security mistake, you'll never know, and if you don't know, you can't learn from it. Learning cryptography is not like learning to ride a bicycle, sadly.

So, I recommend that you start by reading some well-reputed textbooks on applied cryptography and cryptographic engineering. I like Ferguson, Schneier, and Kohno's Cryptography Engineering and Ross Anderson's Security Engineering - I think they give an excellent introduction. However, there are lots of other books that are excellent as well.

-
Strictly speaking, encryption without authentication isn't inherently a mistake, but rather prompt to mistakes on the context of protocols, when misused. For example, data that is to remain in a single place and not be modified or shared should be ok to be encrypted with CBC with no authentication provided. As soon as the encrypted data is used in a protocol (could be read as "shared"), then authentication becomes vital, particularly to avoid things like oracle padding attacks. –  Mamsaac Aug 19 '13 at 6:20
Thank you for the well written answer! I'll go a library and see if they have any books on the subject. –  Patrick Murray Aug 19 '13 at 13:08
+1 for "an insecure scheme looks just like a secure scheme". –  Ilmari Karonen Aug 19 '13 at 13:33
@Mamsaac It depends on your attack scenario. If an attacker is able to read an encrypted file, he often also is able to change it, and then chosen-ciphertext attacks come into play. Authenticated encryption protects against this. –  Paŭlo Ebermann Aug 20 '13 at 7:27
How is she designing her own encryption system? She is using pycrypto to perform all the encryption, the only thing she is doing is generating a random IV and prepending it to the generated ciphertext. As for authenticated encryption - yes she would need that if she wants her messages to be truly secure in transmission between two parties. –  Michael Aquilina Aug 20 '13 at 8:49