128 reputation
14
bio website bluehillsolutions.co.uk
location Leeds, United Kingdom
age
visits member for 1 year, 1 month
seen May 6 at 16:28

Apr
16
awarded  Notable Question
Dec
20
awarded  Popular Question
Jul
20
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
last message and I'm not a 'gotta have the last word kind of guy'. I do not see where you were trying to help me. You basically said that your 'bet' was that the system is full of holes. Without having ANY knowledge of what has been implemented apart from the information given in these posts. And also without suggesting ANYTHING that added any value. Apart from your hunch.
Jul
19
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
"and it sounds like you've used them so poorly as to make them meaningless". Sounds like a challenge ;-) Can you decrypt this value: 6mHdFjxwMWAee4W06x+Yug==
Jul
19
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
Also, periodically ALL data has to be re-encrypted as the key needs to be rotated.
Jul
19
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
So - the requirement is that each value is encrypted in the database and a token is attached to each encrypted value. Further scans of the data MUST return the same token if an encrypted value exists already. Hence the need for the encryption function to produce the same encrypted value for repeating values. How would you implement this without having a static salt ?
Jul
19
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
Hi - thanks for your comments. I'm not trying to receive any assurance that my scheme is ok. It meets the requirements of the business and they are happy with it. My original question was if I used this scheme AND the attacker had the key how easy would it be to crack the data ? There are various protection mechanisms around the key itself so it's extremely unlikely an attacker would get access to both the data and the key. The encryption is not the only line of defence here, there are key coded doors and an isolated network segment to contend with.
Jul
19
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
I'm really curious as to how you come to this conclusion. If you develop a WinForms app are you already an expert on every function within Windows - all of it ? Every function within the .Net framework ? I get the feeling you're a bit of a troll and so will happily take your good luck and wish you a good day.
Jul
19
awarded  Commentator
Jul
19
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
no I'm not. I'm in the position where I just apply the paint to the walls. I don't need to know exactly how the paint was created, i.e. exactly what percentage of each colour makes up my paint. I went to a shop where there were experts in paint and asked them. They were very helpful. To answer your point a bit more fully though and put you in the picture there are several business requirements to meet and they have been met to the satisfaction of the business and the parties that are auditing. Academic arguments about minutiae are interesting and nice to know but not relevant.
Jul
18
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
As a fellow diver I certainly appreciate your answer. I simply don't have time to become an encryption expert so need to make sure I satisfy the business requirements.
Jul
18
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
Thank you. The requirements are that only the encrypted value is stored in the database with a corresponding token. Each load of the value requires a scan to see if the value is already stored, if it is the same token must be returned. So each encrypted value must render the same encrypted value in order for a comparison to me made. I can't think of any other feasible way of doing it. Thanks again for your help and your patience.
Jul
18
awarded  Scholar
Jul
18
accepted AES 256 Encryption - Is it really easy to decrypt if you have the key?
Jul
18
awarded  Student
Jul
17
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
In practical terms it would be very difficult for an attacker to get both the data and the key. But not impossible. I was curious to see how an attacker could derive the scheme, salt and iv just from an encrypted value if he had the key.
Jul
17
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
Yep - take your second point. If I change the IV I cannot meet one of the requirements in that encrypting the same value twice must create the same encrypted cypher text each time. That's a business requirement that I can't get around.
Jul
17
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
I'm really not saying it's not the point. My original question, which still hasn't been answered, is 'How easy is it to decrypt data if all you have is the encrypted data and the key and nothing else'. If it is very easy can someone explain the steps it would take to do so.
Jul
17
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
Ok, so that would be the case. However, my question still remains. If I had asked a different question and Kerckhoffs principle applied then I'd be happy to accept your suggestion. To elaborate, the crypto isn't the question here, I'm working on the assumption that an AES256 encrypted value without the key is safe.
Jul
17
comment AES 256 Encryption - Is it really easy to decrypt if you have the key?
Can someone (preferably the person who did it) explain to me why this was down marked ?