The encryption app that we are using seems to generate the same output for the same input. That is bad right? I'm not smart enough to understand the scheme being used though.

The header of each encrypted file has a string called "hexIdentifier" which is apparently how the app stores the password (hash?) for the encrypted files generated by the app. If we use the same password for different files, then the same HexIdentifier string is used. Does that mean that the password is stored in the file in a trivial fashion that would be easy to re

App is here: http://www.koingosw.com/products/dataguardian.php


Blowfish... I feel younger. This is an algorithm from more than 15 years ago, which is not bad in itself, but the author of Blowfish itself (Bruce Schneier) proposed an enhanced version called Twofish, back in 1998, for the AES competition. That the product claims to be "the ultimate database solution" but neglects the last 15 years of science and technology, including the AES, is not a good sign.

If using the same password for distinct files yields the same "identifier", but a different password produces a different identifier, then this "identifier" can be used to attack the password with cost sharing -- in other words, a rainbow table. An attacker could go through the expense of building the table once, because he could then apply it to every instance of a file coming from that product. This is not a bad sign, this is a worse sign.

None of this means that the password could be trivially extracted from the files (none of this excludes this possibility either), but it is sufficient to recommend not using this product.

| improve this answer | |

It sounds like this "hexidentifier" is a simple hash of the password, and it's at least a weakness that you can determine if different files were encrypted with the same password. That's not necessarily fatal. Most encryption schemes include a "salt" which is effectively part of the password, to prevent the same file from being generated. That's also a weakness.

In general, ad hoc encryption systems developed by well meaning amateurs (like me) are plagued by these kinds of systemic weaknesses. Claiming "1zillion bit blowfish" is blowing smoke. On the other hand, unless you're storing national secrets, your encrypted data is never going to be subjected to the kind of professional attack that could exploir these weaknesses.

| improve this answer | |
  • Just to clarify, if the same password is used we get the same 'HexIdentifier" regardless of what data is being encrypted. – bpqaoozhoohjfpn Oct 2 '12 at 20:23
  • yes, so if they could trick you into revealing the password for one file, a lot of other files could be decripted too (that's your fault for using the same password) but they would know which files (that's the encryption system's fault) – ddyer Oct 2 '12 at 20:37
  • In my limited experience I have never seen app hash the same password to the same value. Isn't that encryption 101? – bpqaoozhoohjfpn Oct 2 '12 at 20:50
  • see my previous comment about "well meaning amateurs" – ddyer Oct 2 '12 at 20:52
  • I don't see how having a salt is a weakness.. – Brendan Long Oct 2 '12 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.