Hi again,
We want to symmetrically encrypt certain data to a key that's provided by the model object. Particularly, we're encrypting it to a secret answer known only to the user. We'd like to encrypt it without the asymmetric encryption - looks pretty easy to adjust in Strongbox::Lock. Would you entertain a patch for that?
For background, we're going to encrypt the secret answer using the normal method, and in the security perimeter we'll be able to then conduct operations that require the decrypted answer - like encrypting new bits of data using it as a symmetric key. Then, at times when the user chooses to enter their secret answer, we can provide some limited decryption for that user's need, while preventing mass exposure of decryptable content to an attacker.
Thoughts?
Randy
I've done more research and while there are some who suggest that for authentication purposes, making the IV a secret can be helpful, the best information I see indicates that the symmetric cbc cypher is no less secure for the initialization vector being in the clear.
Of course, having the IV encrypted to the secret key doesn't normally (in current Strongbox usage) present a practical problem, it does in fact become a practical problem if we wish to use a symmetric-only encryption (using a key that's not always- available) if the private key is unavailable at the moments when the symmetric key is ready for decrypting the ciphertext.
I will provide a patch in the hopes it's acceptable.
Randy