1
$\begingroup$

I am working on financial application where users' data are encrypted with symmetric cipher (AES-256), encryption keys is derived with KDF from user's password. I am looking for way how to give to my users some easy-to-store value (10-15 bytes long) that he stores in a safe and use it as "recovery key" when he forgot his password.

I am studying how key-wrapping works and how it can be used to change (forgotten) password in application where password / passphrase is used as input for encryption key generation (KDF). This article Encryption background: What is key wrapping? discuss how key wrapping works and how can be easy to change user password without need to re-encrypt user's data.

I understand there is no problem when I'm changing password that I know - I know my password, original encrypt key is unwrapped and re-wrapped with new key derived from new password; so far so good.

Question1: How can be key-wrapping mechanism used when I forgot my password? (password is used to create wrapping key). I think that in this situation it cannot done and user's data are lost because I cannot unwrap original encrypt key so I cannot re-wrap original encrypt key. Am I right or wrong?

Question2: Is there some way / mechanism / technique how can I decrypt encrypted symmetric cipher key (AES) with two secret values? One value is derived from password / passphrase and second is from something as Apple's recovery key. I am studying paper Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption but I'm not done yet.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

Question1: How can be key-wrapping mechanism used when I forgot my password? (password is used to create wrapping key). I think that in this situation it cannot done and user's data are lost because I cannot unwrap original encrypt key so I cannot re-wrap original encrypt key. Am I right or wrong?

This is right of course, if you cannot recover the key required for unwrapping then you cannot unwrap.

Question2: Is there some way / mechanism / technique how can I decrypt encrypted symmetric cipher key (AES) with two secret values? One value is derived from password / passphrase and second is from something as Apple's recovery key.

Yes, of course you can. This is quite often performed. It is even possible to require N out of M parts to form or decrypt the final key in certain protocols.

The recovery key size should of course be at least 32 bytes if you want to remain on the same security level as AES-256. Then again, using keys derived from a password will normally not provide 256 bit security either.

Improve this answer
$\endgroup$
7
  • $\begingroup$ Ad question 2 - Marteen, can you suggest me method / technique that allow to decrypt encrypted encryption key with one of two secrets? $\endgroup$
    – jnemecz
    Commented Jun 17, 2017 at 17:13
  • 1
    $\begingroup$ @Artegon: The simplest way is to just wrap the encryption key twice (once with the user's password and once with the recovery key) and store both ciphertexts. For the more complicated access structures Maarten mentions, you'll probably want to use a secret sharing scheme. $\endgroup$
    – Ilmari Karonen
    Commented Jun 17, 2017 at 17:16
  • $\begingroup$ Ad recovery key size you mentioned, Apple uses recovery key 14 character long and AFAIK AES with 256 bit key. $\endgroup$
    – jnemecz
    Commented Jun 17, 2017 at 17:17
  • $\begingroup$ @Artegon That's fine, as long as you don't expect 256 bit security from the 14 character key. I don't know how the key is used, but a 14 character key cannot provide 256 bits security by itself. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jun 17, 2017 at 17:27
  • 1
    $\begingroup$ You cannot create a key that provides 256 bit security out of a key with at most 84 bits of security as Ilmari already demonstrated. It is of course possible to create a 256 bit key out of it and yes, you could use key strengthening to get a bit above the 84 bits provided. It's not that it isn''t secure, but in the end the attacker only has to try $2^{84}$ keys at most. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jun 17, 2017 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.