Objective: To have a very simple to verify, but very secure small message encryption.
Idea: Message ⊕ bcrypt( Password). We remove password biases with
bcrypt and then XOR resulting key with the Message.
Limitation: Only messages up to 320 characters long are supported.
bcrypt salt values are hard coded:
- Salt1 =
- Salt2 =
- Salt3 =
- . . . . . . .
- Salt10 =
Suppose we have
My safe code is 29540323, my bank card pin is 6926
The message is 50 characters long. bcrypt produces keys 32 characters long. So we need 2 keys to match message length:
bcrypt(Password, Salt1) = e8.4zyJT9m9R/KX./Kd2juSHn25IqGUO
bcrypt(Password, Salt2) = emTDJsUVCLFE3Jm8Cjx2S2/WmXEVrrU.
Key (50 characters) =
Code = Message ⊕ Key =
bcrypt de-biasing good enough to use in XOR encryption?
Specific Problem: Attacker knows that the same password was hashed with ten known salts for longer messages.
Specific Question: If the attacker has 10 hashes of the same password with 10 known salts. Given the nature of hashes, does this weaken the password?