2

I am setting up a Python program to encipher messages on the following basis:

-from my password, generate 32-byte key from SHA256(password)

-generate a 16-byte IV from a PRNG

-measure the length of the plaintext and express as 2 bytes (my plaintext will be shorter than 2^16 characters)

-pad the plaintext to be a multiple of 16 bytes

-make an instance of the encryptor = AES.new(key, CBC, IV)

-generate ciphertext = encryptor.encrypt(plaintext)

-make string of concatenated length pt before padding||IV||ciphertext and send to recipient

-also send to recipient the tag from HMAC(key,concatenated string)

My question is whether for security I should use a different key for the AES encryption and for the HMAC tagging?

This seems to me unnecessary, in the sense that with a strong password the chance of finding the key by reverse engineering either the ciphertext or the tag is negligible. Or is it?

user2256790
  • 433
  • 4
  • 12

1 Answers1

2

I'd advise you to use a library with a higher level API, such as Keyczar.

That being said:

  • Don't generate the key using SHA-256. Use a password hash function such as bcrypt or scrypt.
  • Yes, you must use different keys. For example, you can use the password hash function to generate 64 bytes of key material, and use the first 32-byte half for encryption and the second half for authentication.
  • Make sure the IV comes from a good randomness source (e.g. /dev/urandom)
  • Make sure your padding is correct. Or simply use CTR which does not require padding.
Conrado
  • 6,414
  • 1
  • 29
  • 44
  • Thank you for these inputs. Could you very kindly explain why you recommend a higher level API and also why not use SHA-256 to generate the key? – user2256790 Apr 24 '14 at 14:42
  • Sorry for this unintended duplication ---Thank you for these inputs. Could you very kindly explain why you recommend a higher level API and also why not use SHA-256 to generate the key? – user2256790 Apr 24 '14 at 14:44
  • In a higher level API is easier to avoid mistakes, since they take care of the low-level stuff. The reason for not using SHA-256 is in the link provided in the answer, but in short: it's too fast, which makes brute force attacks faster. Furthermore its output is limited to 256 bits and you may need more for generating both keys. – Conrado Apr 24 '14 at 15:05