I have a question about the way to store a key or password that was used for enc
ID: 650196 • Letter: I
Question
I have a question about the way to store a key or password that was used for encryption, so that the application can check if the user put in the right key for decryption. If I make a mistake, please advise me and I will try to avoid such a mistake in the future.
Normally, the key that was used for encryption is stored hashed on the system, so that the application can check if the user used the correct key.
Would it be better to store not the whole key hashed, but split the key into several parts and hash each of these parts? This should make cracking more difficult, because the attacker has to crack several hashes, with different salts (if used). Am I totally wrong with my line of thought?
If yes a little hint would be nice, so that I can investigate in that direction and avoid this mistake in future.
Explanation / Answer
Instead of storing a value based on the key, look at the problem you're trying to solve. You're not actually interested in the value of the key, you just need to ensure decryption works. If you feel you must test the user's input immediately, might I suggest instead storing a value that was encrypted with the key, and testing decryption directly?
The advantage is that security remains equal to the security of the encryption algorithm itself, as opposed to the less-understood (and therefore much more risky) security of a home-brewed hash mechanism.
The disadvantage is that your software would be holding both the challenge and response data, which might help enable a known plaintext attack.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.