Need advice on Cryptography digital files project

Question

I have to choose a topic for my end-of-year school project and I need some advice. I was thinking of implementing an online tutorial materials (digital files) project. I have been researching on cryptography and read on symmetric/asymmetric algorithms. Here is what I have so far:

1. The idea is about creating a system where the course materials are encrypted and can only be decrypted by students of the school's course.
2. The course materials would be encrypted by AES algorithm and the AES key would be stored in the database.
3. The database would contain a table with column "Course" and its corresponding "AESKey". Since it is insecure to store the AES key in clear text, I was then thinking about encrypting it using a password-derived key PBKDF2 (the password of which would be given to the students by the teacher of the course).
4. Then, when the student requests the materials, he would simply provide the password for that course and then be able to retrieve the AES key.

What do you think of that idea? AND how can I make it more secure? Because I wanted to achieve some kind of multi-factor authentication but then it would be infeasible to give smart cards to each and every student! I had been thinking of encrypting the AES key using RSA public/private key method, but then there will be lots of students (Do I create a public/private key pair for each student? Sounds infeasible...) Or maybe there is some other way I can implement the RSA encryption scheme in there? I will be using C# as implementation language.

Your advice is most welcome! Thanks

Answer 1

My first question is why? What are you hoping to gain by encrypting the material and adding the overhead of managing and distributing encryption keys?

There needs to be clear goals defined before you can assess whether the proposed solution is adequate. While your general plan sounds like you have thought it out a bit, it isn't clear what you are trying to do. For example, if all of this encryption is because of some kind of digital rights concerns over the learning materials, then I suspect you are only creating additional overhead and inconvenience for both teachers and students with no real benefit.

Issues you need to think about

How do you verify the student you plan to give the password to is really the student?

How do you know the student won't share their password with others?

How do you know the person using the password is the person they claim to be?

The key problem you have is in establishing levels of assurance. This is almost impossible to do using just passwords. There are lots of other questions - for example, after the student has obtained the materials and used the key to decrypt them, what stops them from distributing the unencrypted versions? Once this occurs, how would you identify who released them?

It seems to be you are facing two problems - establishing identity level of assurance (nearly impossible when based solely on a password) and DRM - nearly impossible without imposing considerable inconvenience on the users.

Sorry if this is sound really negative. I'm not trying to be discouraging. However, from the short description you provided, I think you need to get some greater clarity on exactly what the objectives or business case is you are trying to solve and exactly what the constraints are