I am writing an application that serialises objects and then saves the resultant XML in an encrypted file.

I am using an Initialisation Vector and a Salt both saved in the file for decryption so two files will not be the same even though they may contain the same data.

Is the fact that I will have a recognisable patterns of characters like "<" and "/>" and the header being present within the encrypted output represent a security risk or make it easier to crack the encryption ?

The option I have is to save the values I need to save in a format I understand which will have no patterns other than the data itself but not sure if this is of any benefit.

  • What kind of encryption are you using? – Kotzu Apr 8 '14 at 16:51
  • 2
    Modern crypto is designed to stay secure even if an attacker knows large amounts of plaintext/ciphertext pairs, or even chooses the plaintext. – CodesInChaos Apr 8 '14 at 17:00
  • I am using AES in CBC mode using PKCS5Padding and a 128 bit key. I am trying to encode in both C# and android and have managed to get a compatible encryption using the above encryption. I just wondered if people knew some of the encrypted contents would it aid them in deciphering. – fingletoe Apr 8 '14 at 18:13

If recognizable data patterns in the plaintext do somehow weaken your symmetric encryption, then your symmetric encryption is pure junk and should not be used at all. Do not make your data format inconvenient and complex just to cope with the (assumed) shortcomings of the encryption algorithm; instead, use an algorithm which does things properly.

It is difficult to say more about it without a complete and precise description of the algorithm you use. However, in all generality, we may say that if you probably don't know enough to do things properly (or at least to know whether you did things properly). That's not to be depreciative of your abilities: cryptography is a very specialized subject, and it has the unique characteristic of not being testable. Nobody can really know whether what they implemented is secure; they can test that it works but not that it cannot be attacked.

This applies to trained cryptographers as well. In fact, what distinguishes a trained cryptographer from an "ordinary" developer is not that the cryptographer can design and implement a secure protocol by itself; he cannot either. The real difference is that the cryptographer knows that he cannot make something sufficiently secure by himself.

The way out of this problem is to use an established protocol. For instance, if you want to do "symmetric encryption", then take an existing standard which has been investigated and analysed by many people (e.g. OpenPGP). And then, don't even implement it yourself; instead, use an existing library which has also been reviewed, so that most bugs have been extirpated (e.g. GnuPG).

  • I am a beginner probably in all aspects of programming I am using a AES with CBC and PKCS5Padding with a 128 bit key. I suppose a more precise question is using that encryption algorithm does a pattern in the original plain text make deciphering easier but as you state and also CodesInChaos if it did then the encryption wouldn't be much good but does it have an actual effect at all ? – fingletoe Apr 8 '14 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.