0

Suppose I have an application, which when opened asks you to open a file and then "unlock" that file using a password that's configurable by the user.

The file should be encrypted with something like AES-256, right? The key would be the password, but should the users password be hashed using something like SHA-256? Should I salt the hash as well? If I do salt the hash, do I just store the salt at the start of the file?

Is this the correct way to go about things?

Improve this question
4
  • 3
    A typical (and relatively weak) password usually is not a suitable key for encryption, you need to learn about key derivation functions (en.wikipedia.org/wiki/Key_derivation_function). Those functions often perform key stretching or strengthening, and can slow down bruteforce attacks.
    – reed
    May 13, 2021 at 21:36
  • Just asking to understand your question better - is your application a file-store, that has access controls (user-specific) for different files? Can each user see only the files that are accessible for him/her? Additionally, please check this answer, it may have some useful information for you.
    – M S Sripati
    May 13, 2021 at 21:40
  • @MSSripati When the user uses the app for the first time, they can save the data with their own (customizable) key. So every user has their own files representing the data
    – Win32ApiUSer
    May 13, 2021 at 21:41
  • You can use AES for basic symmetric file encryption. The key can be derived from a password using PBKDF2 or some other key derivation function. See crypto.stackexchange.com/questions/3298/… for how openssl does it, and for the structure of the encrypted file.
    – mti2935
    May 14, 2021 at 1:03

1 Answer 1

Reset to default
1

There can be many different solutions possible. I'd suggest to consider following.

First consider standard tools. Can your users use VeraCrypt?

If not, how about using some broadly used archiving formats like ZIP, RAR, 7z? They all support encryption.

Use any of encryption algorithms that are broadly known like AES-256, ChaCha20, Threefish-256.

Think of proper mode. For instance, if files are relatively big and if you need random access to different file fragments, you may prefer AES GCM to AES CBC.

Applying passwords for encryption as is can make brute-forcing easier, because depending an attacker can test a considerable number of passwords in a short time. Instead, derive the encryption key using algorithms like Argon2, bcrypt, scrypt. Configure it in such way that derivation of a single key takes 1s. Such delay can be acceptable for user and this will reduce brute-forcing speed to 1 password per second.

To derive encryption key you will need the same parameters as used for encryption: salt, the number of iterations, memory factor (Argon2), parallelism (Argon2). That's why you need to store them. How you store them (at the beginning, at the end) is up to you.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .