February 21, 2019 at 10:23 #13277
I initially posted this under the ‘help and support’ forum, but I’m not sure that was the best place, so I’ll post it here also.
I am aware of the changes in password function between version 1.x and 2.x. My work process requires that I still use version 1.x which allows for different passwords. I assume that version 1.7.3201.0 is the last stable version of 1.x – Is this true?
I have heard lately that SHA1 is not secure, and SHA2 should now be used. I don’t know much about encryption so here is my main question –
I read that version 1.x utilizes SHA1 in the encryption process, and version 2.x uses SHA2. How does the use of SHA1 affect the security of a file that is encrypted with version 1? Does the use of SHA1 create a vulnerability only ‘during’ the encryption or unencryption process, and presents no risk once a file is encrypted and exists as a static file? Or, is there a weakness even after the encryption is done and the file is stored on a drive?
I also understand that version 1.x uses 128 bit encryption, and version 2.x uses 128 or 256. However, the main question is how SHA relates to the security of the encryption process as a whole.
Is there any difference in security between the same file, first encrypted with 128 bit under verions 1.x, and the same file encrypted with 128 bit under version 2.x?
Thanks for any help understanding this.February 26, 2019 at 16:30 #13311
Yes, AxCrypt-1.7.3201.0 is the last stable version of 1.x. You can also check the same using our legacy website http://www.axantum.com/AxCrypt/LegacyDownloads.html .
The data encryption primitive is AES-128 or AES-256 in AxCrypt 2, while it’s always AES-128 in AxCrypt 1.
We use SHA-512 for two things – an HMAC, that’s a cryptographically strong checksum that ensures that we can be sure that nothing in the encrypted file has been changed. We also use it for password derivation – this is a process whereby we take a variable length typed password, and produce a fixed length (128 or 256-bit as the need be) value to use for the actual encryption algorithm. It’s essentially just another representation of the typed password, and we never store this anywhere.
Please read up on the full details here: http://www.axcrypt.net/documentation/technical/ .
Also, please check our security page, https://www.axcrypt.net/information/security/ .
SHA stands for Secure Hashing Algorithm. SHA-1 and SHA-2 are two different versions of that algorithm. They differ in both constructions (how the resulting hash is created from the original data) and in the bit-length of the signature. Primarily, people focus on the bit-length as the important distinction. SHA-1 is a 160-bit hash. SHA-2 is actually a “family” of hashes and comes in a variety of lengths, the most popular being 256-bit.
Please read to know the difference between the SHA 1 and SHA 2, https://en.wikipedia.org/wiki/SHA-2#Comparison_of_SHA_functions