I found out that an encryption tool encrypts and stores the passphrase entered by the user and used to generate the AES key in addition of the encrypted payload.


key = md5(passphrase)
iv = 0
cipher = Cipher(key, "AES/CBC/PKCS7", iv)
encryptedpayload = cipher.encrypt(payload)
cipher = Cipher(key, "AES/CBC/PKCS7", iv)
encryptedpassphrase = cipher.encrypt(passphrase + chr(0))
// Write encryptedpayload and encryptedpassphrase Base64 encoded to file

The reason to store the encryptedpassphrase is that the tool uses it to decide whether the given passphrase for decryption is the correct one, so the user can be notified if the passphrase is wrong.

If AES a safe way to encrypt any information, there should be no problem to encrypt the passphrase, nevertheless I have a bad feeling.

Especially as there is no salt used and the IV is always set to 0.

And the length of encryptedpassphrase gives some information about the length of the passphrase (if it's 16 bytes long, then the passphrase can't be longer than 15 bytes due to the appended 0 byte before encryption).

So I'd like to know is this encryption scheme fine or should this tool be avoided?

And what is the best practice to detect whether the entered passphrase is the correct one to decrypt the ciphertext?

  • If the encryption were secure this wouldn't cause problems. But since the encryption is vulnerable to padding oracles this leads to key recovery. – CodesInChaos Oct 5 '14 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.