1

I was wondering if such practice would be safe:

  • I have a table that stores encrypted notes
  • Every note has a data field and a password field
  • When a password is entered, i want to select all notes, encrypted with that password
  • For this purpose, i need to safely store the password next to the data
  • There can be many notes and many different passwords

To solve this problem, here's what i do:

  • Encrypt the data to be stored with an AES key, generated by PBKDF
  • Hash the key with md5
  • Store the md5 version of the key next to the data

Here's what i'm thinking:

  • MD5 is super insecure!
  • So we have a better chance brute forcing the MD5 hash to recover the original key
  • But ...
  • The key itself is 256 bits
  • So in theory, brute forcing such an md5 hash should still be a nightmare ... or am i wrong?

What would be a better alternative for storing a password hash (i only need it for determining which notes to select from db)?

Thanks for your thoughts

Improve this question
4
  • 1
    If 2 users use the same password, should they see the documents encrypted by the other user as well? or only those that they encrypted themselves?
    – Nzall
    Commented Nov 18, 2014 at 8:38
  • There's only one user per app. So no problem with seeing the same messages with the same pass.
    – Marius
    Commented Nov 18, 2014 at 8:46
  • If there is only 1 user per app, why do you need multiple passwords? Wouldn't it be easier to just have the user authenticate and let him use his own password for decryption?
    – Nzall
    Commented Nov 18, 2014 at 10:17
  • Well, there could be less sensitive passwords for less sensitive content and there could be strong passwords for very sensitive content. It's basically a form of categorization, based on sensitivity. You're right - it would be easier, but ... it's merely a personal preference.
    – Marius
    Commented Nov 18, 2014 at 10:22

2 Answers 2

Reset to default
2

From what I can tell from the comments, you want to use stronger and weaker passwords depending on the sensitivity of the file. For that, I suggest a different approach: Instead of having different passwords, require an extra password for the more sensitive documents. So all files are encrypted by default by the standard password, and the more sensitive files are encrypted AGAIN by the stronger password. Have the user authenticate using his default password when he starts the app, and then ask him for the sensitive password every time he wants to access the sensitive files.

If you want to store which notes are encrypted with the same password, you don't need to store the password itself. In fact, don't store the password at all. Store the security level of the file (low/medium/high) and ask for passwords based on that security level.

Improve this answer
2

From Wikipedia:

A 2013 attack by Xie Tao, Fanbao Liu, and Dengguo Feng breaks MD5 collision resistance in 2^18 time. This attack runs in less than a second on a regular computer.[2]

This means that there's a weakness in MD5's ability to distinguish between different input data - that two arbitrary inputs may calculate the same hash.

In April 2009, a preimage attack against MD5 was published that breaks MD5's preimage resistance. This attack is only theoretical, with a computational complexity of 2^123.4 for full preimage.[40][41]

This means that there is a theoretical weakness in MD5, allowing you to locate a preimage from the result value. If your MD5 is 508e01033ebe14c9c339b9928d7ce4bd, someone may in the future (given enough computational power) use the preimage attack to find that the original password was hfghfhghfhgf.

Improve this answer
5
  • It does not matter if someone produces the same MD5 with a different input - good luck decrypting AES encrypted data with that "different key". As far as the second point goes, yep ... that's a problem. So what would you recommend instead of my approach?
    – Marius
    Commented Nov 18, 2014 at 8:49
  • No no, 2^123.4 is a good number! Of course, if you want your system to be "theoretically good", you wouldn't want to use MD5, but one with a better reputation (SHA-2/3). That said, I don't really see why you need the hash. You could just try decrypting the data. If it fails, the password's obviously wrong?
    – Henning Klevjer
    Commented Nov 18, 2014 at 9:26
  • 1
    Ah, thanks for the explanation. As for why i need the hash ... well ... to get the list of notes that are encrypted with the same password. I can't just go decrypting every row in the database trying to find the ones that do decrypt :) So i need a simple way to filtering out only the notes i need.
    – Marius
    Commented Nov 18, 2014 at 9:29
  • 1
    Your first paragraph on collision resistance is incorrect. Collision resistance is resistance against finding any two inputs with the same result. If you have a hash and want to compute an input with that hash (in the example of the testament), you're talking about pre-image resistance. See here: en.wikipedia.org/wiki/Cryptographic_hash_function#Properties
    – user21287
    Commented Nov 18, 2014 at 16:13
  • Yikes. I've edited my answer.
    – Henning Klevjer
    Commented Nov 19, 2014 at 6:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .