0

i have googled and searched quite alot but most things just state the same things but not answering my questions so hopefully you guys can help me out abit

Story: i am looking at creating an encryption software for my self and friends to encrypt messages & files with AES 256 (in java)

Questions: Serval other softwares using AES 256 encryption support any key length such as a 10char insted of the 16. how is that possible (such as winzip's aes encryption)?
the same way the other way. how can the encryption depend on the key strength when the key has to be 16 chars what i was thinking was if the passharse was less than 16 then fill the remaining chars with a predefined seed if the passharse was longer than 16 then use the overlapping chars as a salt.

am i missing something completely? how can the encryption strength be based on how good the passharse is when its required to be 16 chars regardless

how would i go about securely using AES256 yet still beable to encrypt other peoples files (who uses the same software)

and last question is there anyway to notice what type of encryption is used? do they have a patten that can be seen in the hex ? would having multiple encryption types (with same passharse or predefined modification) do any good?

NSA has stated they can crack nearly anything with a farm of super computers is a 16 char passharse really that hard to brute with a datacenter full of super computers

  • 1
    Hello and welcome to Information Security! There are a lot of questions in your question, making it very broad. Perhaps you should ask them one at a time instead? – Anders May 25 '16 at 21:48
  • 2
    Also, are you doing this for fun and education, or are you doing it to actually use for encrypting sensitive information? The first rule of crypto is do not roll you own crypto. Even the best always makes mistakes, so if you are looking for something to use for sensitive information, pick an existing library that has been extensively tested instead. – Anders May 25 '16 at 21:50
  • Thank you for answering. I am doing this to educate my self but i would like my software to be secure, i am using bounycastle as a provider ? the reason am not using library is because am unaware of any that does what i want, i looked abit at some maybe you can point me to an library that has the functions (the 2 i listed) in a secure manner? the "main" question is why is aes 256 secure when it requires 16 chars passharses and how can software such as the encryption on zip files have any passharse they want regardless of length ? what are they using the passharse for if not keys – PleaseEducateMeLovelyInternet May 25 '16 at 21:54
  • i would also like a simple code audit on the 2 functions i posted as i really think am missing some sorta point (works fine i just dont get how that sorta code can be secure its just 16 chars that should beable to be cracked with a farm of GPU computers ? ) and there are any kinda of pattens that gives away its AES? is there a point in hiding the encryption type? – PleaseEducateMeLovelyInternet May 25 '16 at 22:01
  • This is not the place to ask for code reviews, I'm afraid. As it is worded now your question is likely to get closed. I would recommend you to narrow it down to only be about what you described as you "main question". – Anders May 25 '16 at 22:04
2

Serval other softwares using AES 256 encryption support any key length such as a 10char insted of the 16. how is that possible (such as winzip's aes encryption)? the same way the other way. how can the encryption depend on the key strength when the key has to be 16 chars what i was thinking was if the passharse was less than 16 then fill the remaining chars with a predefined seed if the passharse was longer than 16 then use the overlapping chars as a salt.

They are transforming the passphrase into a key, by using the hash of the password or other key stretching mechanism.

Of course, any other software wishing to interoperate with your software shall implement it the same way. Just like your program should be using an IV or using AES in some cipher mode (EBC, CBC, CFB, CTR…).

Concretely, zip specification will combine the user-provided passphrase with two salt bytes and use 1000 rounds of HMAC-SHA1-based PBKDF2.

am i missing something completely? how can the encryption strength be based on how good the passharse is when its required to be 16 chars regardless

how would i go about securely using AES256 yet still beable to encrypt other peoples files (who uses the same software)

You have to follow the zip AES encryption specification.

Alternatively, use a library which already handles that for you, like 7-zip

and last question is there anyway to notice what type of encryption is used? do they have a patten that can be seen in the hex ? would having multiple encryption types (with same passharse or predefined modification) do any good?

zip files have a field indicating the kind of encryption used.

NSA has stated they can crack nearly anything with a farm of super computers is a 16 char passharse really that hard to brute with a datacenter full of super computers

A 16-byte key is a 128-bit key, which nowadays is considered. Note that this is quite different to a 16-character password, which would be ~70 bits.

  • thank you so very much, this has cleared alot of things up for me. However 1 follow up question, regarding the indicating of encryption. Is there anyway to see a file is encrypted with AES as a pose to blowfish as a sample? (without a indicating field i only use winzip as a sample) does encryptions have noticeable pattens ? (also everywhere i said 16chars i meant 32. my bad xD) – PleaseEducateMeLovelyInternet May 26 '16 at 0:31
  • If it's a proper encryption, you wouldn't be able to differentiate one kind of random-looking bytes from others. Usually the most you can do is to make some informed assumption based on the block size that seems to have been used. – Ángel May 26 '16 at 0:36
  • thank you very much for your time educating a newbie like me. Since indications are not possible (if done properly) would having a list of encryption types such as BLOWFISH,AES,CAMELLIA,THREEFISH within the software, then telling the user who needs to decrypt the file to use encryption A and then B and then C. Do any good? or is it just pointless overkill? this will not be on the fly encryptions so speed is not really an issue but is it pointless todo it like that? does that give any kinda benefit vs brute force? – PleaseEducateMeLovelyInternet May 26 '16 at 0:41
  • Storing the encryption type within the file would be simpler. You wouldn't gain much from hiding which algorithm you used. It's better that the user has a good password than having him remember the encryption parameters that were used for that file. – Ángel May 26 '16 at 0:45
  • am sorry if am just being dumb but if i have a list of encryptions types vs just having aes wouldn't they have to brute force each encryption method untill password is found aswell as the correct encryption type is found? i was thinking of ordering them 1. AES 2. BLOWFISH, etc etc so you would have to remember 1 number (or multiple if you wish to double encrypt) and the passhrase – PleaseEducateMeLovelyInternet May 26 '16 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.