0

I am encrypting text files using AES256 (no particular reason, that can easily be changed). Before granting access to a file, I need to verify if a party knows the correct key, but without necessarily having direct access to the system's keyring (for instance, a file could be moved between different machines).

I thought of doing the following: before encryption I write the key on the first line of the file. Upon decryption I compare the key that is supplied by a user with the first line of the file decrypted using that same key. If they match it means that the user is authorized and I return the file minus the first line.

This can only be less safe than not including the key! But how much?

  • 3
    I don't get it. If the user is able to decrypt the file, he obviously knows the key. If you are trying to differentiate between a correctly decrypted file, and a incorrectly decrypted one, why not just use a checksum to verify the file? – lzam Sep 17 '14 at 0:56
  • 1
    Yeah, that sounds a lot better..! So are you suggesting that I store the checksum in the first line of the encrypted instead of the key? – Ziofil Sep 17 '14 at 1:02
  • 2
    Don't do this yourself. Use an encryption mode that has authentication built-in, like AES-GCM. – Stephen Touset Sep 17 '14 at 1:03
  • @Ziofil, the end of the file may make more sense. Ideally, though, you should find a good library to handle all of this for you, and not try to implement everything from scratch. – lzam Sep 17 '14 at 1:15
  • @Izam: "If the ..., ... knows the key." doesn't help against someone who doesn't know the key but will later learn it. – user49075 Sep 17 '14 at 4:11
0

If you have a good encryption algorithm, it shouldn't matter that you include the encryption key. However, better than storing the password itself you better store a salted hash. Or just a truncated version of it (the basis being that a user error is unlikely to mistype one of the very few colliding passwords, while a brute-force attack would not be able to use it for knowing for sure that it got the right password).

But we shall also take into account that we additionally want the file not to be modified. So we can just include a hash of the file and if it is there and matches what you decrypted, he knows the password. GCM as suggested by Stephen is also an alternative to including a hash.

  • Thank you for the confirmation, I ended up using exactly a hash. It was so simple! – Ziofil Sep 21 '14 at 22:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.