Encryption app stroring the password

Question

The encryption app that we are using seems to generate the same output for the same input. That is bad right? I'm not smart enough to understand the scheme being used though.

The header of each encrypted file has a string called "hexIdentifier" which is apparently how the app stores the password (hash?) for the encrypted files generated by the app. If we use the same password for different files, then the same HexIdentifier string is used. Does that mean that the password is stored in the file in a trivial fashion that would be easy to re

App is here: http://www.koingosw.com/products/dataguardian.php

Answer 1

Blowfish... I feel younger. This is an algorithm from more than 15 years ago, which is not bad in itself, but the author of Blowfish itself (Bruce Schneier) proposed an enhanced version called Twofish, back in 1998, for the AES competition. That the product claims to be "the ultimate database solution" but neglects the last 15 years of science and technology, including the AES, is not a good sign.

If using the same password for distinct files yields the same "identifier", but a different password produces a different identifier, then this "identifier" can be used to attack the password with cost sharing -- in other words, a rainbow table. An attacker could go through the expense of building the table once, because he could then apply it to every instance of a file coming from that product. This is not a bad sign, this is a worse sign.

None of this means that the password could be trivially extracted from the files (none of this excludes this possibility either), but it is sufficient to recommend not using this product.

Answer 2

It sounds like this "hexidentifier" is a simple hash of the password, and it's at least a weakness that you can determine if different files were encrypted with the same password. That's not necessarily fatal. Most encryption schemes include a "salt" which is effectively part of the password, to prevent the same file from being generated. That's also a weakness.

In general, ad hoc encryption systems developed by well meaning amateurs (like me) are plagued by these kinds of systemic weaknesses. Claiming "1zillion bit blowfish" is blowing smoke. On the other hand, unless you're storing national secrets, your encrypted data is never going to be subjected to the kind of professional attack that could exploir these weaknesses.