If I want to encrypt some block of text in AES, but at the time of decryption I don't have a way to check if the symmetric key is the correct one. So I:

  1. Generate a randomKey, and use that to encrypt the text.

  2. Encrypt the randomKey plus its hash using the user provided Key.

  3. Save everything to a file.


var userKey;
var plainText;

var randomKey256 = generateHexString(256);
var hash256 = sha(randomKey256);
var signature512 = concat(randomKey256, hash256);
var header = AES256_encrypt(signature512, userKey);

var cipher = AES256_encrypt(plainText, randomKey256);

var encryptedFile = concat(header, cipher);


var userKey;
var encryptedFile;

//split encryptedFile in header|dataCipher
var header = encryptedData.substring(0,512);
var dataCipher = encryptedData.substring(512, null);

var signature512 = AES256_decrypt(header, userKey);

//split signature512 in RandomKey|Hash
var randomKey256 = signature512.substring(0,256);
var hash256 = signature512.substring(256,256);

    //valid key

    var plainText = AES256_decrypt(dataCipher, randomKey256);
    //invalid user key

Obviously this is not real code. I understand that I will not be implementing my own security. I'm assuming that the whole thing would be encrypted in a safe environment. The user key is NOT going to be transmitted or stored anywhere.


What you did seems fine for verifying the key is correct.

However, unless AES256_encrypt uses an authenticated mode of encryption (in which case the whole exercise would be unnecessary), there is nothing that prevents an attacker from modifying the message. And depending on the mode of encryption used, that can even compromise the privacy of the message.

It would be best to use authentication. For example, you could calculate an HMAC over the data. That immediately proves that the HMAC key is correct if the message authenticates. To prove the AES key is correct as well you can derive them both from the same base key, e.g. a = HMAC(k, 'auth'), e = HMAC(k, 'enc') and then use key a for an HMAC over the ciphertext and e for AES encryption.

| improve this answer | |

For the symmetric key crypto, generally speaking, you must provide the secret key to the other end for decryption. The same random keys can be generated at the receiver end, if you use same function with same parameters.

I am also a bit confused, since you have also used "signature" word in your program. Are you talking about the encryption or the signature? Note, the generation of signatures are different than encryption.

| improve this answer | |
  • $\begingroup$ I called the random key and hash concatenation a "signature" it's not but more of a checkable block at the begining of my container file $\endgroup$ – Vitim.us Nov 6 '15 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.