Encryption Security With Version 1.7.3201.0 vs Version 2.x

[Steve]

I am aware of the changes in password function between version 1.x and 2.x. My work process requires that I still use version 1.x which allows for different passwords. I assume that version 1.7.3201.0 is the last stable version of 1.x – Is this true?

I have heard lately that SHA1 is not secure, and SHA2 should now be used. I don’t know much about encryption so here is my main question –

I read that version 1.x utilizes SHA1 in the encryption process, and version 2.x uses SHA2. How does the use of SHA1 affect the security of a file that is encrypted with version 1? Does the use of SHA1 create a vulnerability only ‘during’ the encryption or unencryption process, and presents no risk once a file is encrypted and exists as a static file? Or, is there a weakness even after the encryption is done and the file is stored on a drive?

I also understand that version 1.x uses 128 bit encryption, and version 2.x uses 128 or 256. However, the main question is how SHA relates to the security of the encryption process as a whole.

Thanks for any help understanding this.

 

[SvanteSpectator]

Hello Steve,

The use of SHA-1 in AxCrypt is actually still ok, and it does not affect the security in the sense that it’s easier to decrypt because of the limitations of SHA-1. It is used for two things – to produce a 128-bit key from your password, and to make a so-called HMAC – a keyed message authentication code, or a checksum. In extreme theory, although as mentioned in this use case it’s not practical, a low-security HMAC would enable an attacker to make a change to the encrypted data, and the HMAC would not flag this change. The decrypted data would still be wrong, and it will not help the attacker decrypt the data. The use of SHA-1 to produce the actual 128-bit key used for encryption is also a safe use. It will not help an attacker to decrypt the file.

[Author]

Posts