0

So, I'm experimenting a bit with secure python programming if there is such a thing :D). This is half a real world project, and half just a training exercise. So both theory and practical advice is appreciated.

I am using an AES salted encryption script which encrypts text in the manner ...

data = "hello"
encrypted_text = encryption(data, salt_word)
print encrypted_text (responds with "huio37*\xhuws%hwj2\xkuyq\x#5tYtd\xhdtye")
plain_text =  decryption(encrypted_text, salt_word)
print plain_text (responds with "hello")

QUESTION: If you know the values of "encrypted_text" and "plain_text "...can you reverse engineer the "salt_word". AND if so, how hard is it (12 seconds on a PC, or 20 years on a Cray?)

My understanding from the entire point of AES is, no you can't. But I'm just not that familiar.

I'm using an insignificantly modified version of the script here: Encrypt / decrypt data in python with salt

Basically, it uses the "salt" to encrypt "data". salt is a string, and data comes out as a string of encrypted characters.

Using decrypt, with the same salt string, returns the data to normal text.

Community
  • 1
  • 1
RightmireM
  • 2,381
  • 2
  • 24
  • 42
  • What do you mean by "salt"? Are you salting a password to produce an AES key? – Duncan Jones Jun 11 '13 at 14:10
  • It's a bit hard to tell without knowing what `encrypt` method you are using. I seem to miss the part where the key or password is injected. A salt is normally only used for a Password Based Key Derivation Function (PBKDF) or - for less secure implementations - salted hash values. – Maarten Bodewes Jun 11 '13 at 22:38

1 Answers1

1

When you say salt with AES, what specifically are you talking about? Is this the IV to CBC or CTR mode? Is it a salt used for key generation with a passphrase (PBKDF2)?

In either case, salt's aren't usually kept secret. IV's can be transmitted in the clear, and with hashing schemes, are usually stored along with the hash (otherwise it'd be impossible to compute the hash a second time).

I've given a previous answer as to why it's safe to transmit IV's in the clear, which you can find here.

Community
  • 1
  • 1
mfanto
  • 14,168
  • 6
  • 51
  • 61