5
$\begingroup$

I need to encrypt a file, distribute it over an insecure channel, and decrypt it later. Using a symmetric-key algorithm. Here's what I intend to do:

Get a password P from the user. Generate a 16-byte random salt S. Derive a key K1 = PBKDF2(HMAC-SHA1, P, S, iter=2000, bits=256). Divide the data into blocks of 1024 bytes each. For each block, generate a random 16-byte IV. Encrypt each block with AES-256 with key K1 and this IV. For each block, calculate D = HMAC-SHA2 of the concatenation of IV and encrypted data. For each block, write out the IV, the ciphertext and D.

Now I need to store and distribute the salt too. For this, I derive key K2 = 1000 iterations of SHA2("somefixedtext" + P) and IV2 = 500 iterations of SHA2("someotherfixedtext" + P). The salt is then encrypted with AES-256 with key=K2, IV=IV2 and stored alongside the ciphertext.

OK, so is this secure enough?

$\endgroup$
  • $\begingroup$ Your salt encryption step doesn't make much sense. Why not just include the plain salt? $\endgroup$ – CodesInChaos Aug 29 '12 at 17:06
  • $\begingroup$ Were the salt known to the attacker, isn't it as good as not using a salt? Couldn't he try to use the salt + dictionary words to derive K1 himself? $\endgroup$ – file-encrypter-noob Aug 29 '12 at 17:15
  • 2
    $\begingroup$ @file: The purpose of the salt isn't to add more unknowns, it's primarily to a) prevent the password+salt combo from being located in a pre-computed dictionary, and b) to allow the same password to be derived to different keys if needed. The only thing we must keep from the attacker is the password. $\endgroup$ – B-Con Aug 29 '12 at 18:09
  • $\begingroup$ You should rather use AES in GCM mode, instead of creating your own authenticated encryption scheme with HMAC. $\endgroup$ – mat Apr 14 '17 at 15:13
3
$\begingroup$

First off, you are still missing some information. What encryption mode will you be using? What key are you using for the HMAC?

That said, my answer is no. This isn't a good way. The reason being is that unless you are a professional cryptographer, you shouldn't design your own cryptographic protocols/methods. There are too many ways to introduce vulnerabilities in both the design and the implementation that it is risky. Stick with published standards that the cryptographic community has been able to look at and analyze. You can encrypt files using PGP or the open source implementation GnuPG.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.