4

I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together. Both the data and the password are encrypted with a random key that is unrelated to the user's password. The user password is hashed using jasypt.org.(StrongPasswordEncryptor).

  1. How should the random password be encrypted?
  2. Is this a potential security vulnerability?
  3. Is there anything in what I have described that is incorrect or needs improvement?
Improve this question
6
  1. The random password is called a key, it's encrypted (IIRC) with the same AES algorithm as you specified to encrypt the file with. In this case it's AES-128 with your personal password.
  2. Not really, it's actually better, because when you destroy the header containing the key, then no-one would be able to crack the encrypted file/volume, even if they have your password. It's also easier to change the password. If you would use your password to encrypt the file and you would change it, then you would first need to decrypt the volume and re-encrypt it with the new password. Whereas when using a key, you just need to decrypt and re-encrypt the key.
  3. It's better if you call the random password 'key'.
Improve this answer
5
  • Thank you very much, one more question. Jasypt ( jasypt.org/api/jasypt/1.8/org/jasypt/util/password/… ) used to hashed the user's password, is weak compared to AES-128? Or this consistent?. Sha-3 would be better?. Or what would you recommend? – user60108 Feb 7 '13 at 20:28
  • I don't understand your question sha3 and AES are two different things. SHA3 is a hashing alo and AES an encryption algo. – Lucas Kauffman Feb 7 '13 at 20:43
  • I think the author is wrong, he doesn't know the difference between hashing and encrypting. # – Lucas Kauffman Feb 7 '13 at 20:46
  • sorry for my English. Jasypt used (SHA-2) to hashed the user password, would this be the weak point in comparison with the data encrypted with AES-128? Should I use sha-3, right? – user60108 Feb 7 '13 at 20:47
  • You should and it is a weak point, but not weak in such a way that it it makes it useless. It's still strong. – Lucas Kauffman Feb 7 '13 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.