Are there any security implications of converting a byte-array encryption key in

Question

Are there any security implications of converting a byte-array encryption key into a Base64 string before use?

I am creating a generic encryption helper for a project, and for the sake of consistency and generality, I use byte arrays for all inputs and outputs (plain data, key, salt, etc)

However, the encryption library I use internally expects strings. I am worried that encoding the key as a base64 string before use might somehow weaken it's strength in terms of entropy, etc.

Any thoughts? In general, does Base64 encoding affect encryption strength in any way?

Explanation / Answer

There is no way that a modern encryption library operates on characters. All modern ciphers are defined to operate on bytes (some are defined to operate on bits, but most libraries will assume a byte is the minimum unit of data). If your library accepts character strings then they will be converted to bytes within. Note that e.g. std:string does not have to contain character strings, it can contain byte strings (a.k.a. octet strings) as well.

On the other hand most encryption libraries use the full range of the key space. This means that the bytes that make up the key can have any value. So as long as your base 64 encoded key has a valid key size it may be accepted. In that case the only problem is that base64 will contain 3/4th of the entropy of a fully random key. So if you have a 192 bit AES key it will be converted to an AES 256 bit key. In that case you should not claim 256 bit security, as the amount of possible keys in your scheme is still 2^192.

If the encryption library itself decodes the base64 then your key is first converted 1:1 to base64 and then back to the original key again. Obviously in such a case base64 does not make a difference. You would expect that conversion from base64 or hexadecimals is well documented for the library.

Related Questions

Navigate

• Browse (All)
• Browse A
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.