What are "input" and "pass" used for in AES encryption algorithm?

Question

I was just taking a look at the AES encryption algorithm and have some questions.

Function AESEncryption(ByVal input As String, ByVal pass As String) As String
    Dim AES As New System.Security.Cryptography.RijndaelManaged
    Dim Hash_AES As New System.Security.Cryptography.MD5CryptoServiceProvider
    Dim encrypted As String = ""
    Try
        Dim hash(31) As Byte
        Dim temp As Byte() = Hash_AES.ComputeHash(System.Text.ASCIIEncoding.ASCII.GetBytes(pass))
        Array.Copy(temp, 0, hash, 0, 16)
        Array.Copy(temp, 0, hash, 15, 16)
        AES.Key = hash
        AES.Mode = Security.Cryptography.CipherMode.ECB
        Dim DESEncrypter As System.Security.Cryptography.ICryptoTransform = AES.CreateEncryptor
        Dim Buffer As Byte() = System.Text.ASCIIEncoding.ASCII.GetBytes(input)
        encrypted = Convert.ToBase64String(DESEncrypter.TransformFinalBlock(Buffer, 0, Buffer.Length))
        Return encrypted
    Catch ex As Exception
    End Try
End Function

I was wondering what the parameter input is and what the pass is. Is the pass the password, if so what is the input.

If this is for passwords, [they should be hashed](http://stackoverflow.com/q/31146658/1070452) not encrypted. Encrption can be undone, Hashing is a one way street — Ňɏssa Pøngjǣrdenlarp, Nov 15 '15 at 17:59
@Plutonix For a college project would encryption be good enough. I agree that hashing should be used and i would/will use it if my product was to go commercial. — User59, Nov 15 '15 at 18:57
Encrypting PWs is simply not the right thing to do. If the point of the project is to show you researched and learned something use hashing. Hashing is simpler than most Encryption methods because you would have to write a Decryption method to check/verify passwords whereas the same Hash method can be used to hash PWs for saving *and* for checking logins — Ňɏssa Pøngjǣrdenlarp, Nov 15 '15 at 19:02
@Plutonix Hmm, yes you are right, I will look into hashing further. Thanks! — User59, Nov 15 '15 at 19:06
That link I posted has all the code you need including comparing a login attempt — Ňɏssa Pøngjǣrdenlarp, Nov 15 '15 at 19:09
You *could* put it in a click event (that code is for hashing the PW for a new user!). Generally it is a bad idea to glue app logic to forms. If it were my code, there would be a User class and that would be part of the Save method with the contents of the PW textbox passed in. You could split the difference and call a method from the click event - you want to be sure to use the same hashing for adding new and checking a login. The only difference in the code is where the salt comes from — Ňɏssa Pøngjǣrdenlarp, Nov 15 '15 at 19:50

score 0 · Answer 1 · edited Apr 13 '17 at 12:48

A symmetric cipher like AES enables you to hide some plaintext (input) with some key which produces the ciphertext (encrypted). In order to recover the plaintext from the ciphertext, the same key is used.

AES supports keys of 128, 192 and 256 bit, but passwords have usually arbitrary length (and not much entropy). This code uses the password argument (pass) as input to a single MD5 hash invocation in order to derive a key of 128 bit. This is not very secure, because MD5 and AES are quite fast and an attacker may try a lot of passwords per second (brute force) in order to decrypt the ciphertext. A better way would be to use an iterated Password-based Key Derivation Function like (PBKDF2, bcrypt, scrypt) to derive a key from a password. See more: How to securely hash passwords?

ECB mode is not very secure, because it leaks some structure of the plaintext to the ciphertext as seen by the ECB penguin. CBC mode with a random Initialization Vector (IV) should be used in order to achieve semantic security.

Even better would be to add authenticity by either using an authenticated mode like GCM or EAX or using an encrypt-then-MAC scheme with a strong MAC function like HMAC-SHA256.

What are "input" and "pass" used for in AES encryption algorithm?

1 Answers1