I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together. Both the data and the password are encrypted with a random key that is unrelated to the user's password. The user password is hashed using jasypt.org.(StrongPasswordEncryptor).

  1. How should the random password be encrypted?
  2. Is this a potential security vulnerability?
  3. Is there anything in what I have described that is incorrect or needs improvement?

1 Answer 1

  1. The random password is called a key, it's encrypted (IIRC) with the same AES algorithm as you specified to encrypt the file with. In this case it's AES-128 with your personal password.
  2. Not really, it's actually better, because when you destroy the header containing the key, then no-one would be able to crack the encrypted file/volume, even if they have your password. It's also easier to change the password. If you would use your password to encrypt the file and you would change it, then you would first need to decrypt the volume and re-encrypt it with the new password. Whereas when using a key, you just need to decrypt and re-encrypt the key.
  3. It's better if you call the random password 'key'.
  • Thank you very much, one more question. Jasypt ( jasypt.org/api/jasypt/1.8/org/jasypt/util/password/… ) used to hashed the user's password, is weak compared to AES-128? Or this consistent?. Sha-3 would be better?. Or what would you recommend?
    – user60108
    Feb 7, 2013 at 20:28
  • I don't understand your question sha3 and AES are two different things. SHA3 is a hashing alo and AES an encryption algo. Feb 7, 2013 at 20:43
  • I think the author is wrong, he doesn't know the difference between hashing and encrypting. # Feb 7, 2013 at 20:46
  • sorry for my English. Jasypt used (SHA-2) to hashed the user password, would this be the weak point in comparison with the data encrypted with AES-128? Should I use sha-3, right?
    – user60108
    Feb 7, 2013 at 20:47
  • You should and it is a weak point, but not weak in such a way that it it makes it useless. It's still strong. Feb 7, 2013 at 20:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .