Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'd like to know if Aescrypt is a valid tool, or if for a very secure protection, the only choice is to use a software like gpg, or similar.

More I've another curiosity, if one doesn't want to use encrypted email with a related software, could it be secure send AES encrypted files, through normal email connection ? Could it be usefull to use a rar AES protected archive, to further protect files ?

Thanks

share|improve this question

2 Answers 2

up vote 4 down vote accepted

See this question for some caveats. There is nothing positively wrong which is reported about it, but it seems to use custom format and password-to-key processing, which means that it was not well analyzed. I see no mention of an integrity protection. Therefore I would recommend caution until further analysis.

Assuming that AESCrypt does everything right (including integrity checks), then yes, sending by email files which are protected by a password is fine... provided that you choose strong enough passwords, and that you have a way to convey the password to the intended recipient with all the needed confidentiality. It would not buy you much to use both the innate encryption features of RAR and an additional encryption layer, especially if both use the same password.

Systems which support asymmetric encryption like GnuPG will still make your life easier. You still have to make sure that you have the right public key (the one owned by the recipient), but at least it is a public key so you can transmit it securely with less constraints (you can dictate the hash by phone, but you do not have to fear people who merely spy on the phone line, contrary to speaking a password over the phone).

share|improve this answer
1  
“I see no mention of an integrity protection” The file format includes an HMAC. I haven't checked how that field is used, but it's a hint that there is at least an authenticity check. –  Gilles Oct 5 '12 at 20:05
    
yes, I had already read that discussion, and it's been usefull, thanks @Gilles thanks –  webose Oct 5 '12 at 22:21
    
+1 for PGP suggestion, should be a no-brainer even if it's simply for manual exchange of symmetric key and AEScrypt is subsequently used. –  deed02392 Nov 26 '13 at 17:13

AES is a symmetric encrypting algorithm while GPG is meant to provide asymmetric encryption. AES does not provide authentication or integrity. While with GPG you can have both.

With AES you will share a key with someone, whilst with GPG you will be able to share public keys with each other. Meaning a person can verify (providing your private keys do not get stolen) that the file received from your email address is actually also sent by you.

If you encrypt a file with AES to then again rar it with AES you are not really providing too much extra security providing you have a strong key.

share|improve this answer
    
as I reach the 15 reputation point I'll point up this aswer, thanks –  webose Oct 5 '12 at 22:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.