Should a password based AES CBC encrypted string have extra security?

Question

For a Java application that I wrote, I take a password provided by a user and generate a 128-bit AES key from it using 100,000 iterations of PBKDF2-HMAC-SHA512 with a randomly generated 512-bit salt. I use this key to encrypt a file using AES-CBC mode encryption and then I do something with that encrypted data.

What bothers me is that it seems like someone could just generate passwords and then decrypt the first couple of bytes of the cipher-text and see if non-garbage comes out.

Am I being paranoid or is there extra work that can be done?

For example, is there a mode of AES which prevents partial decryption of cipher-text? Or anything else that slows down the process of testing lots of keys?

Answer 1

The ability to decrypt a portion of the ciphertext is not critical.

It is common practice, for example in disk encryption programs, to add a fixed (known) string to the ciphertext and thus check if the password fails. Regardless which mode you are using, this would not be the critical point.

CBC mode has only one significant weakness: CBC mode does not prevent tampering attacks, that means, an attacker who guesses a part of the ciphertext, is able to modify it according to its purposes. If available, use GCM, EAX, CCM or OCB mode.

Answer 2

is there a mode of AES which prevents partial decryption of cipher-text

I claim to be no expert in cryptography, but my understanding of chain block cipher (CBC) is it has weaknesses primarily caused by lack of authentication. Although, because its initialisation vector (IV) is a fixed value (IV predicability), this IV outputs the last block of the ciphertext. You can view how different AES implementations conceal data about an image "Text partially decrypted regardless of IV".

"Decrypting with the incorrect IV causes the first block of plaintext to be corrupt but subsequent plaintext blocks will be correct. This is because each block is XORed with the ciphertext of the previous block, not the plaintext, so one does not need to decrypt the previous block before using it as the IV for the decryption of the current one." - Block cipher mode of operation

Galois/Counter Mode (GCM) is often thought of as GCM = CTR + authentication. AES-GCM with proper IV implementation is considered more secure than other AES alternatives. GCM is preferred because it's a faster algorithm and unlike CBC, GCM supports authentication. However, GCM "if you reuse a nonce. A single repeated nonce allows an adversary to recover its authentication subkey, plus to learn the XOR of the two messages with the same nonce." which is obviously not ideal. Also, GCM uses 96 bits IVs, making collision rates higher and IV reuse potentially more frequent.

This thread How to choose an AES encryption mode? should assist as it outlines different AES implementations, which should allow you to choose which is appropriate for your infrastructure.

Although, despite all this, I would opt for CBC for local storage. GCM has felt more for network (real time) encrypted communications.

Or anything else that slows down the process of testing lots of keys

I will presume by keys you refer to passwords. Where you want to pass the passwords through a one-way hashing function with multiple iterations (rounds) for storage by something (likely database).

Password hashing seems more important. I have read multiple disputes regarding using SHA-2 family for password hashing, most criticism comes from SHA-2 not performing multiple iterations, something you have already done, but this does not concern your scenario directly as you are using PBKDF2 with HMAC SHA512. However, I would review what type of system your potential attacker has, and implement a modern hashing algorithm to protect against that. E.g. do they use CPU, GPU or ASIC to brute force the PBKDF2. Argon2 has been known for good resistance against most brute forcing attempts. Comparing the three Argon2 algorithms:

• Argon2d: best protection against GPU brute force.
• Argon2i: optimised to resist side-channel attacks. It accesses the memory array in a password independent order.
• Argon2id: a hybrid of Argon2d and Argon2i.

All three modes allow specification by three parameters that control:

• execution time
• memory required
• degree of parallelism

These specifications should be considered for all password hashing algorithms. PBKDF2 is a known, and recognised hashing function which is considered to be secure for password hashing. However, it's recognised as being weak against an ASIC brute force.

I would choose between Argon2id or PBKDF2 HMAC SHA512, and evaluate depending upon which type of attacker I am defending against.