AES Encryption pycrypto and salting

Question

I don't have a problem with my code but I don't understand the different arguments you can use with pycrypto and AES encryption. so where I define my encryptor below, what is mode, and IV? the tutorial I found this on didn't really help me understand it. I have it working properly but I want to understand that the arguments are.

so Question #1: What are the arguments associated with defining a encryptor with pycrpto?

Question #2 is this an appropriate salting method for the encryption. I'm using a very long randomized ascii string, then converting it to a 256bit sha then using that to do AES encryption on the information, then I base64 encode and insert into the database.

def pad(string):
   return string + ((16-len(string) % 16) * '{' )

password = hashlib.sha256("").digest()  
IV = 16 * '\x00'
mode = AES.MODE_CBC
encryptor = AES.new(password, mode, IV=IV)

encrypted_customer_name = encryptor.encrypt(pad(customer_name))
encoded_ecryption_name = base64.b64encode(encrypted_customer_name)  

customer_name = base64.b64decode(customer_name)
decryptor = AES.new(password, mode, IV=IV)
customer_name = decryptor.decrypt(customer_name)
lenofdec = customer_name.count('{')
customer_name = customer_name[:len(customer_name)-lenofdec]

My code isn't in that order but I didn't include all of the code just the relevant parts.

Answer 1

Ok I'm going to do my best here to answer these questions!

Q1:

Ok it looks like the signature is

new(key, *args, **kwargs)

The first argument key is pretty self explanatory, but after that you notice that it can take a number of keyword arguments.

It seems that it can take:

1. mode: The cypher mode (these are as follows. Look on wikipedia for definitions)

   MODE_ECB = 1 Electronic Code Book (ECB). See blockalgo.MODE_ECB. MODE_CBC = 2 Cipher-Block Chaining (CBC). See blockalgo.MODE_CBC. MODE_CFB = 3 Cipher FeedBack (CFB). See blockalgo.MODE_CFB. MODE_PGP = 4 This mode should not be used. MODE_OFB = 5 Output FeedBack (OFB). See blockalgo.MODE_OFB. MODE_CTR = 6 CounTer Mode (CTR). See blockalgo.MODE_CTR. MODE_OPENPGP = 7 OpenPGP Mode. See blockalgo.MODE_OPENPGP.

2. IV: the salt (you seem to already understand this)

From here on out the options seem to be based on the specific mode you are using

3. counter: A function that returns the next block of data (not normally used). From the docs:

   (Only MODE_CTR). A stateful function that returns the next counter block, which is a byte string of block_size bytes

4. segment_size is the size of the segment in CFB mode

The Pycrypto docs

Q2: Is this a good method for salting your encryption?

First what is the salt for? I find that this is a very common question that people ask, I mean we already have a password, why else would we need a key?

The answer makes a lot of sense when you talk about passwords. Lets say my password is banana, when we write this to a password file we would send it through a hash algorithm and get 5a814... (sha256).

Now next time someone tries to use the password banana they get the same hash. Any one with permissions to the file can then look and see that the passwords are the same. This is where the salt comes in. If I append a random salt before running through the hash algorithm then the hash will come out different every time, even if the passwords are the same. This makes your system WAY more secure.

Alright now for your code:

First, congrats you are calling the function correctly! But... Your code sets IV = 16 * '\x00' this is not a very good salt at all. I would recommend using os.urandom(16) to generate high quality entropy (uses system entropy) and place the output in your code. It is common practice to write the salt into the beginning of the the encrypted content.

This is tricky to say without knowing what you are attempting to do with code, but let me explain with an example:

# Get User password

MODE = AES.MODE_CBC

def encrypt(msg, password):
    salt = os.urandom(16)
    password = sha256(password)
    crypter = AES.new(password, mode=MODE, IV=salt)
    return "{}:{}".format(salt, crypter.encrypt(msg))

def decrypt(enc, password):
    salt, content = enc.split(':')
    password = sha256(password)
    crypter = AES.new(password, mode=MODE, IV=salt)
    return crypter.decrypt(content)

I hope this was helpful! Happy Coding!