1
$\begingroup$

I am making a password manager , I am new to cryptography, so , can someone tell me if this can be a good solution?

1- the user inputs the email/password 2- all the payload gets encrypted with aes@256bit and saved on a public blockchain

It should work right? and one more thing: as you know storing data on the blockchain is expensive , so , is AES a good algorithm for space optimization ?

New contributor
alwaysInTheBasement is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
$\endgroup$
3
  • 1
    $\begingroup$ Why is your password manager linked to a blockchain? Is this a learning exercise, a personal tool, or something you intend to share? I would recommend doing something like KeePass/KeePassXC. Alternatively, you could do a command-line program like pass, except please don't use GPG. $\endgroup$ 2 days ago
  • $\begingroup$ @samuel-lucas6 it's just a learning exercise I will deploy it on the bitcoin blockchain, with 1000s of nodes (better than bitwarden, right?) $\endgroup$ 2 days ago
  • 2
    $\begingroup$ There are anyways risks when developing software even if the cryptography is perfect. What if an attacker manages to send our a malicious update to your AES library? Then you might be strong badly encrypted passwords on the Blockchain for everyone to see. If this is not on the Blockchain, at least the damage is somewhat contained to whatever file synchronization system you're using. $\endgroup$
    – lamba
    2 days ago

1 Answer 1

2
$\begingroup$

I'm not sure what you'd use the email for in the above scheme, but sure, that can be done. To transform a password into a key you'd need a password-based key derivation scheme (PBKDF). You could use the email as additional input, e.g. by using it as a salt or part of a salt.

Furthermore, you would need a mode of operation for AES. AES is a block cipher so itself simply takes a 16 byte plaintext as input and then produces a 16 byte ciphertext. A mode of operation can be used to encrypt multiple, longer messages. The result will however be at least as large as the password store: AES does not compress data in any way, and usually you'd need to store an IV and possibly an authentication tag.

Yes, you can store ciphertext in a public location. Storing it on a blockchain seems wasteful though. Generally, it seems more logical to store it in the cloud and keep local copies (and KeePass apps generally support Google and Dropbox, for instance).

$\endgroup$

Your Answer

alwaysInTheBasement is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.