I'm working on a mobile application with which a signed in user can send encrypted data to a serverside backend. Also, the user may log in to some website on his laptop and view his encrypted data then decrypted.
My plan is to use AES for encryption but I can not figure out a good solution how to handle the AES key. As a user's password is often not >= 128 bit strong, I don't won't to use the user's password for encryption. Also, generating a key and storing it somewhere in a remote database is a bad idea in my opinion as the key would be accessible for any intruder.
So, is there a best practice to handle such situations?

  • $\begingroup$ TL;DR: use the password to derive a key (PBKDF), encrypt the bulk encryption key using this key. Answer to follow soon. $\endgroup$ – SEJPM Aug 16 '16 at 18:08

This answer will orientate around "Method to Protect Passwords in Databases for Web Applications" by Contini, you really should read this paper and follow it with the here proposed modifications.

Your objective is to secure an AES key on the server end, because it needs to be available regardless of devices and the only ressources you can use are usernames and (bad) passwords.
The obvious strategy is to encrypt this key and only temporarily decrypt it when needed using the password. For this you derive a key from the password using a password-based key derivation function (PBKDF) and encrypt the key afterwards with AES-GCM, which will tell you whether the decryption is valid and the user is authorized as a bonus.
In regards to this, the paper will tell you to hash the password hash one more time on the server end. You replace this with the AES-GCM decryption of the key. Additionally you should use Argon2, scrypt, bcrypt or PBKDF (in order of preference) for the client-side password hashing.

So far for the modifications, now for a quick TL;DR of how the scheme roughly works:

  1. Ask the server for access, include the username and the server (domain?) name
  2. Receive the username, website and server-side secret dependent salt (even for usernames that don't exist in the database)
  3. Do the password hashing and send the result to the server
  4. Try to decrypt the AES key using the password hash
  5. Grant or deny access based on whether the user exists and whether the hash was correct
| improve this answer | |

One way is to use Diffie-Hellman key agreement with elliptic curve cryptography (ECC) algorithm to generate a secret key. You may use this key to cipher/decipher using AES encryption system. The security of your system would be as good as the confidenciality of the algorithm from ECC to generate key pair.

In adittion, you would store this key at your server, when the user wants to decipher you could generate another key so you could send to him with security.

| improve this answer | |
  • $\begingroup$ So the authentication method would be as strong as the difficulty of reverse-engineering the point generator method and brute-forcing the password? $\endgroup$ – SEJPM Aug 16 '16 at 19:38
  • 2
    $\begingroup$ How does this solve the problem? The ECC keys still need to be stored somewhere. $\endgroup$ – otus Aug 17 '16 at 6:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.