6
$\begingroup$

I need to encrypt a file, distribute it over an insecure channel, and decrypt it later. Using a symmetric-key algorithm. Here's what I intend to do:

Get a password P from the user. Generate a 16-byte random salt S. Derive a key K1 = PBKDF2(HMAC-SHA1, P, S, iter=2000, bits=256). Divide the data into blocks of 1024 bytes each. For each block, generate a random 16-byte IV. Encrypt each block with AES-256 with key K1 and this IV. For each block, calculate D = HMAC-SHA2 of the concatenation of IV and encrypted data. For each block, write out the IV, the ciphertext and D.

Now I need to store and distribute the salt too. For this, I derive key K2 = 1000 iterations of SHA2("somefixedtext" + P) and IV2 = 500 iterations of SHA2("someotherfixedtext" + P). The salt is then encrypted with AES-256 with key=K2, IV=IV2 and stored alongside the ciphertext.

OK, so is this secure enough?

Improve this question
$\endgroup$
4
  • $\begingroup$ Your salt encryption step doesn't make much sense. Why not just include the plain salt? $\endgroup$
    – CodesInChaos
    Commented Aug 29, 2012 at 17:06
  • $\begingroup$ Were the salt known to the attacker, isn't it as good as not using a salt? Couldn't he try to use the salt + dictionary words to derive K1 himself? $\endgroup$
    – file-encrypter-noob
    Commented Aug 29, 2012 at 17:15
  • 2
    $\begingroup$ @file: The purpose of the salt isn't to add more unknowns, it's primarily to a) prevent the password+salt combo from being located in a pre-computed dictionary, and b) to allow the same password to be derived to different keys if needed. The only thing we must keep from the attacker is the password. $\endgroup$
    – B-Con
    Commented Aug 29, 2012 at 18:09
  • $\begingroup$ You should rather use AES in GCM mode, instead of creating your own authenticated encryption scheme with HMAC. $\endgroup$
    – mat
    Commented Apr 14, 2017 at 15:13

1 Answer 1

Reset to default
3
$\begingroup$

First off, you are still missing some information. What encryption mode will you be using? What key are you using for the HMAC?

That said, my answer is no. This isn't a good way. The reason being is that unless you are a professional cryptographer, you shouldn't design your own cryptographic protocols/methods. There are too many ways to introduce vulnerabilities in both the design and the implementation that it is risky. Stick with published standards that the cryptographic community has been able to look at and analyze. You can encrypt files using PGP or the open source implementation GnuPG.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.