0

I am coding an online password manager as part of my apprenticeship.

I have already coded the full backend to synchronize the encrypted data and a frontend that encrypts and decrypts data with AES. So far, no secrets are shared with the backend.

How do I avoid storing other data and especially unencrypted data in the database via reverse engineering on the frontend?

7
  • 1
    Why do you want to avoid storing something unencrypted that someone worked hard to store? What is the risk to you? What is the risk to the user who intentionally bypassed your encryption?
    – schroeder
    Nov 17, 2021 at 21:44
  • @schroeder I would like to keep the data coherency in the DB. Nov 17, 2021 at 22:00
  • Do you plan to execute any query on the database? Is there a method that someone can bypass your frontend?
    – kelalaka
    Nov 18, 2021 at 0:19
  • There's something I don't understand about this question. Do you regularly have people or applications you don't control adding data to your database that you weren't expecting? Or are you concerned about some kind of attack where the hacker inserts data rather than stealing what's already there? Please explain.
    – John Wu
    Nov 18, 2021 at 0:38
  • @JohnWu My goal is to have a clean backend, i.e. homogeneous data. This is my concern. I also want to know if there is a risk at the same time? That's why I'm asking this question? Nov 18, 2021 at 12:58

2 Answers 2

1

Ciphertext encrypted with AES should be indistinguishable from randomly distributed bytes. So, if the bytes submitted to your back-end do not appear to be randomly distributed, then it is safe to assume that these are not ciphertext.

However, the converse is not always true. If the bytes submitted to your back-end appear to be randomly distributed - they may be ciphertext. Or, they might just be randomly generated bytes.

2
  • I understand that there is no real solution to this problem. I will content for no verification on the data for now. I left the problem open to know the answer of people more competent than me on the subject. Nov 17, 2021 at 22:25
  • @EstébanRistich There are statistical functions that you can use to determine if data falls into a uniform random distribution. See math.stackexchange.com/questions/2435/…. You could run such a test on your back-end, and if the bytes do not appear to be of a uniform random distribution, reject the submission. Of course, this would probably require some tuning, especially if the number of bytes is small.
    – mti2935
    Nov 18, 2021 at 13:50
0

How do I avoid storing other data and especially unencrypted data in the database via reverse engineering on the frontend?

If you really don't want any unencrypted data in the database, you could perform a second encryption on each piece of data prior to putting it into the database (with a key on the server) .

Alternatively, you could just turn on full-disk encryption on the server (e.g., Bitlocker, etc.). The data would not be encrypted at the logical level, but would be encrypted at the disk level.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .