4

I'm using a password to encrypt some data. However, upon decrypting, I want to check if the entered password is correct. In order to do so I encrypt the password itself. Then upon decrypting, I check if the password given matches with the encrypted password.

Is it unsafe to encrypt my password with the password itself?

Thomas Wagenaar
  • 343
  • 1
  • 7
  • Well if you use different IV for each password and encrypt it 100.000 times it should be ok. – Aria Aug 06 '18 at 21:53

2 Answers2

2

This post might be useful to you. I can't see a problem with encrypting the password using the same password as the encryption key, but there are other ways to verify the decryption was successful as mentioned in the post I linked, such as using a HMAC or an authenticated encryption mode such as AES with GCM.

Joe
  • 2,734
  • 2
  • 12
  • 22
1

Someone who is brute-forcing your password will be able to easily validate if the password is correct. But otherwise, most encryption algorithms should not be made vulnerable by encrypting the password using a key derived from that same password.

Does the data you encrypt have any kind of structure that you can check when decrypting? If the password and subsequent encryption key, is incorrect, the decrypted data will be garbage.

Silver
  • 1,824
  • 11
  • 23