File encryption with nppcrypt
-
Hi,
I’ve been fiddling with file encryption in Notepad++ and nppcrypt plugin. Everything seems to work fine but I’m not sure about the encryption header (xml-stuff above the encrypted data) which every encrypted file contains. Doesn’t this header make it easier for an attacker to decrypt the encrypted data? I know very little about encryption so my concerns might be unnecessary. I’ve read the FAQ saying that this header can be deleted but then the whole npp++/nppenc encryption becomes very user unfriendly.
I was thinking if there was an option to set all those additional encryption parameters for all the files with a certain extension, so that they don’t have to be in the file header.
For example:
All the files with extension .txenc will have these addional encryption parameters:<nppcrypt version=“1016”>
<encryption cipher=“rijndael” key-length=“32” mode=“gcm” aad=“true” encoding=“base64” />
<key algorithm=“scrypt” N=“16384” r=“8” p=“1” salt=“xjF0Kr4enp3Uo/iOYywCEA==” />
<iv value=“CzSr5CZHqFUSNlJbrjrk6w==” method=“random” /><tag value=“Disvwdh4XABuLT/pdyIm2g==” />
</nppcrypt>So none of the .txenc files need to have the encryption header (xml-stuff above the encrypted data) and when opened, nppcrypt will only ask for password.
Again, sorry for my silly concerns - like I said earlier, maybe the encryption header will not make it any easier for an attacker to decrypt the data at all, or very little and all that matters is the password lenght/complexity.
-
@ric-cze said in File encryption with nppcrypt:
Doesn’t this header make it easier for an attacker to decrypt the encrypted data?
Simple answer: Yes, if you know which algorithm was used, you don’t have to test any others, at least not in a brute force attack.
But is that important? Only if the vulnerability is known or the algorithm used is weak anyway.
