I am writing a back-up application which should have the feature of encrypting the back-up. It must encrypt file data, paths and filenames. The application is being written in C# (.NET). Target is Windows systems, but potentially also other platforms under Mono.
It seems that AES should be used with an instance of the RijndaelManaged class. The encryption and decryption functions can be given an IV, a secret key, and of course the data.
The user will get to input a password or passphrase of any length. They'll be advised to choose something reasonable, like between 8 and 50 characters. The password will be stored in some form of hash. I'm not sure yet if this will be scrypt or bcrypt or something. Even though the back-up can be decrypted with this, at least the original password will not be known.
- Any expansion needed to get a key that AES can work with is done by AES itself, right? Or do I need to expand the input (with some secure function?) to a key length that AES accepts myself?
- Both the IV and Key must be the same during encryption and decryption in order to succesfully decrypt the data. The key is always the same. What should the IV be?
I am guessing that the IV could be an incrementing number, which would make the encryption still look random even when the data and key are identical, so that it leaks as little information as possible. Is this assumption right? Does that mean that a good IV would be the file ID (they all get a unique number, or at least that could be generated)? - A metafile is kept which maps path and file IDs to the original path and filename. For example path 1, file 3 could expand to C:\Windows\explorer.exe. This metafile will probably be plaintext, only the values (path and filenames) will be encrypted. What should the IV be for the values? Their numeric id? Or a random value that is stored somewhere in plaintext? Or can I use a fixed (hardcoded) IV?
- Is there anything I should know when running (or attempting to run) the application in Mono? Can I rely on any sources of pseudo-randomness to have enough entropy?
- Does AES provide integrity by default, or do I need to store a MAC (or something) of each encrypted piece of data (metadata and file data)?
If you know the answer to any of these questions, any help is much appreciated!