Is this encryption "secure"?

Question

I must first say that I have never studied cryptography, and all I know about this topic is just basic concepts.

We looked for a quick and easy way to encrypt some data (which will be stored in the database) using a password. I know that the “safest” algorithm is AES, but it is probably too complicated for us, and I know that this requires us to obtain permissions from the US government, etc.

We thought of this (simple) algorithm, which reminds me (but I could be wrong) of a kind of "One-time panel". (it is not written in any particular language ... it's just an idea :))

// The string we need to encrypt string data = "hello world"; // Long string of random bytes that will be generated the first time we need to encrypt something string randomData = "aajdfskjefafdsgsdewrbhf"; // The passphrase the user selected string passphrase = "foo"; // Let generate the encryption key, using randomData XOR passphrase (repeating this one) string theKey = ""; j = 0; for(i = 0; i < randomData.length; i++) { theKey += randomData[i] ^ passphrase[j]; j++; if(j == passphrase.length) j = 0; } // Encrypt the data, using data XOR theKey (with theKey.length >= data.length) string encryptedData = ""; for(i = 0; i < data.length; i++) { encryptedData += data[i] ^ theKey[i]; } 

On disk, we will then store only randomData and encryptedData. passphrase will be requested from the user every time.

How secure would such an algorithm be? Are there any other ways that can be hacked? I don’t think that statistical analysis will work on this, right? Is it "safe" like a "Disposable Panel"?

Thanks!

Answer 1

No, this is not safe.

If random data is stored together with encrypted data, then this is simply equivalent to XORing with a passphrase: this is because an attacker can simply XOR encrypted data with random passphrase and result in a plaintext XOR passphrase.

Answer 2

You can simply import the AES library and let it do all the hard work. Permits from the US government? This is a public function, and the US government also uses it.

Answer 3

This is extremely weak. Statistical analysis would crack it in no time. Some diligent hand and paper guesses will probably also crack it soon.

The only exception would be if (1) randomData was taken from a truly cryptocurrency source, (2) randomData was at least as long as your plaintext data (3) randomData was ever reused for another message, and (4) you completely got rid of passphrase and processed randomData as your key. In this case, you will have what constitutes a one-time notebook.

Answer 4

No, this is not safe. Using xor with random data and password this way is completely wrong. A single cryptographic curve requires random data to be the same length as the data that needs to be encrypted.