I found out that an encryption tool encrypts and stores the passphrase entered by the user and used to generate the AES key in addition of the encrypted payload.
key = md5(passphrase) iv = 0 cipher = Cipher(key, "AES/CBC/PKCS7", iv) encryptedpayload = cipher.encrypt(payload) cipher = Cipher(key, "AES/CBC/PKCS7", iv) encryptedpassphrase = cipher.encrypt(passphrase + chr(0)) // Write encryptedpayload and encryptedpassphrase Base64 encoded to file
The reason to store the encryptedpassphrase is that the tool uses it to decide whether the given passphrase for decryption is the correct one, so the user can be notified if the passphrase is wrong.
If AES a safe way to encrypt any information, there should be no problem to encrypt the passphrase, nevertheless I have a bad feeling.
Especially as there is no salt used and the IV is always set to 0.
And the length of encryptedpassphrase gives some information about the length of the passphrase (if it's 16 bytes long, then the passphrase can't be longer than 15 bytes due to the appended 0 byte before encryption).
So I'd like to know is this encryption scheme fine or should this tool be avoided?
And what is the best practice to detect whether the entered passphrase is the correct one to decrypt the ciphertext?