2
$\begingroup$

I have a personal project in mind in which I plan to use cryptography in order to let the users be confident in the fact that, even if all data get's stolen, it would be virtually impossible to crack in the next few decades.

I would like some advice on the way I planned it until now:

All data resides in two key/value stores:

Store 1 - contains messages:

  • key : msg_id (numerical)
  • value : AES encrypted message with random key K1.

Store 2 - links users to messages:

  • key : hash H1 of (user identification + password + X)
  • value : AES encrypted data containing the msg_id and key K1, encrypted with key K2 (identification + password + salt/padding)

( X increments from 1 to N, per message linked to user. I use this to create more noise, should there be an attack, and to differentiate the hash H1 with key K2).

Without any regard to the way it should work (which is quite specific): is the data contained in the two stores safe even if an attacker knows their architecture and has access to the application's source code ? They may know some user id's, but not their password.

BTW: I'm quite new to cryptography. I'm reading through the basic materials (applied cryptography by Bruce Schneier, for one), so please be indulgent.

Improve this question
$\endgroup$
3
  • 2
    $\begingroup$ Could you describe the purpose of the messaging system? For example, is it for me to send a message to myself, or is it for me to send a message to someone else. If it is the latter, I don't see how that "someone else" could decrypt the message. $\endgroup$
    – mikeazo
    Apr 18, 2012 at 15:49
  • 1
    $\begingroup$ Store 2's keys and K2s would be too easy to calculate from the pass-phrase. See tarsnap.com/scrypt.html. $\endgroup$
    – user991
    Apr 18, 2012 at 23:49
  • $\begingroup$ Thanks for the comments, I'm rethinking the system more thoroughly for the moment. Rest assured, I'm not implementing anything for the time being ;) $\endgroup$
    – Berzemus
    Apr 26, 2012 at 10:00

1 Answer 1

Reset to default
2
$\begingroup$

First, as a bit of general advice: Designing a secure cryptographic system is hard. Experts with decades of experience still make mistakes. Depending on your intended audience, you may be better served by looking for an established system that meets your needs rather than trying to design an implement something from scratch.

To answer your specific question above, I would suggest that the keys of store 2 are one weak point. With a list of these keys, and one or more user IDs known, it's straightforward to implement a dictionary attack to try and discover the associated passwords. (X does nothing to help protect the passwords, because it is not random.)

Passwords are notoriously a weak point of most systems in use today, thus you might contend that this is unavoidable, but you should still strive to avoid making it easy to do an offline dictionary attack.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Good point. But what if pass-phrases are enforced instead of passwords ? Wouldn't dictionary or brute-force attacks become too difficult then ? $\endgroup$
    – Berzemus
    Apr 18, 2012 at 20:09
  • $\begingroup$ @Berzemus: use some slow password hashing algorithm like Bcrypt to generate the keys from the passwords. $\endgroup$
    – Paŭlo Ebermann
    Oct 2, 2012 at 17:01
  • $\begingroup$ This answer would be more useful if you named specific systems that met those needs. Are you perhaps thinking of Freenet, or what? $\endgroup$
    – David Cary
    Oct 2, 2012 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.