There is a JSON array like this:
[
{
"date": "28.08.23 10:52",
"type": "text",
"data": "card number including expiration date and CVC"
},
{
"date": "29.08.23 10:52",
"type": "text",
"data": "bank password in the form admin:password"
},
{
"date": "30.08.23 10:52",
"type": "text",
"data": "coordinates where I buried the corpse."
}
]
This array is then subjected to JSON.stringify(json)
and encrypted with the AES-128-ECB algorithm.
What I end up with is this:
j0SoAqGRf1bLDc1rIbyT1PSSoFQgpXXYvk3kibRrSo71Ndgrhe4nczhIaeoeSYkgXP0ICqTPo0c01dBuGklSLaPDsdn6HQe6UnOL4tfrit2bUvCwdg3ofPJ8RPl4wRRqGYCk5n24OEXW1rcchdZRRiOE2mgEthPi9z0l0VJkbDRhjyCTcFZfyc2RfSKD/nVk0FAsT5DDwVwYqxom5U/1msblLtoNGZn8amCLd0KntZ6kmYo1v2pxoXq2KB33er86Zu8M8E36amVI0bbgJcI5+uMMmUp/zRdcpRLAD4sKTjbp7yXKLVV8NYF4JDjETaupGcrEGECp0lgt59Iii4lvYLA6AWD+ZXWZISoq5S+Nxt+nfSG97g/26tB4qE8AIqKh
Now we simulate a hacking attempt.
We don't know what's stored in the value of the keys, but we do know:
- that it was JSON;
- that each block contains the keys "date", "type" and "data";
- that most likely the type field has the value text, but not for sure;
- It is also possible to know what is specified in date.
Does this knowledge make hacking easier in any way?
I realize that using an IV would solve everything, but I don't know where and how to store it because it has to be different and classified every time.
I want to store important information on the Internet in encrypted form so that I can easily access it. That is, it's a page on GitHub pages, where I share encrypted data and a password field. I enter the password and this data is decrypted using JavaScript. Everything happens on the client side, which is my side.
This is all very convenient up to the point where I only have a "password" field. For example, in JavaScript the Web Crypto API (native support) is excluded from the AES-ECB methods, which can exist without iv because they don't consider it secure enough. I can use the Crypto-JKS library which has ECB, but there is a security issue here.
Hence, I have to look towards GCM or CBC where IV is a prerequisite for decryption. I can't memorize IV, but then I don't know where and how to store it.