I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it

Things I know/think are problematic

  • using base64 digest + getting the first 32 char reduces key size, right?
  • where should the salt be generated and stored
  • should the encryption include some kind of counter
  • should the aes IV be new each time the vault is encrypted?

Here are the diagrams of getting/setting the password file from and to the server: Blue values are input by the player in a prompt orange values are stored in a file on the client after authentication (not included in the diagrams)

getting the vault

setting the vault

  • $\begingroup$ Can you explain the rationale for the SHA256/base64 digest/first 32 characters part? $\endgroup$
    – Modal Nest
    Nov 13 '20 at 16:14
  • $\begingroup$ @ModalNest The aes function needs exactly 32 bytes key size, therefore the "first 32 chars", the base64 is just a random hash digest I chose (which is wrong, I should instead just use the raw hash bytes instead of a digest like base64 or hex) $\endgroup$
    – CodingKiwi
    Nov 14 '20 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.