I am encrypting text files using AES256 (no particular reason, that can easily be changed). Before granting access to a file, I need to verify if a party knows the correct key, but without necessarily having direct access to the system's keyring (for instance, a file could be moved between different machines).

I thought of doing the following: before encryption I write the key on the first line of the file. Upon decryption I compare the key that is supplied by a user with the first line of the file decrypted using that same key. If they match it means that the user is authorized and I return the file minus the first line.

This can only be less safe than not including the key! But how much?

  • 3
    I don't get it. If the user is able to decrypt the file, he obviously knows the key. If you are trying to differentiate between a correctly decrypted file, and a incorrectly decrypted one, why not just use a checksum to verify the file?
    – lzam
    Sep 17, 2014 at 0:56
  • 1
    Yeah, that sounds a lot better..! So are you suggesting that I store the checksum in the first line of the encrypted instead of the key?
    – Ziofil
    Sep 17, 2014 at 1:02
  • 2
    Don't do this yourself. Use an encryption mode that has authentication built-in, like AES-GCM. Sep 17, 2014 at 1:03
  • @Ziofil, the end of the file may make more sense. Ideally, though, you should find a good library to handle all of this for you, and not try to implement everything from scratch.
    – lzam
    Sep 17, 2014 at 1:15
  • @Izam: "If the ..., ... knows the key." doesn't help against someone who doesn't know the key but will later learn it.
    – user49075
    Sep 17, 2014 at 4:11

1 Answer 1


If you have a good encryption algorithm, it shouldn't matter that you include the encryption key. However, better than storing the password itself you better store a salted hash. Or just a truncated version of it (the basis being that a user error is unlikely to mistype one of the very few colliding passwords, while a brute-force attack would not be able to use it for knowing for sure that it got the right password).

But we shall also take into account that we additionally want the file not to be modified. So we can just include a hash of the file and if it is there and matches what you decrypted, he knows the password. GCM as suggested by Stephen is also an alternative to including a hash.

  • Thank you for the confirmation, I ended up using exactly a hash. It was so simple!
    – Ziofil
    Sep 21, 2014 at 22:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .