Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I'm developing an application that will use public key authentication to contact some webservice. So the user has his keypair on his computer, and I want that file to be encrypted using AES with a key derived from a user's password.

I'm wondering if I'm using relatively "safe" parameters and way of writing the file.

Here are the PBKDF2 and AES parameters:

  • PBKDF2 Iterations : 1024
  • PBKDF2 Hash function : SHA256
  • PBFDF2 Salt size : 256 bits
  • PBKDF2 Derived key size : 256 bits
  • AES Cipher mode : CFB

Here is how the file is written:

  • Salt (Hex encoded)
  • Return line
  • IV (Hex encoded)
  • Return line
  • Encrypted file content (Hex encoded, encrypted using AES in CFB mode and the key derived from the user's password)

Maybe what's missing here is a HMAC (with SHA256, for example) to "guarantee" that the file hasn't been tampered with. Here's how probably I'd append it to the file, after "Encrypted file content":

  • Return line
  • HMAC-SHA256 with the content's encryption key

Thanks in advance.

share|improve this question
1024 iterations is very low. If you can afford the performance hit, use a larger value. On a desktop computer you should be able to afford a million iterations. –  CodesInChaos Oct 9 '13 at 10:09
increase iterations, reduce salt size. You do not need to encrypt the public key, but it should be authenticated. Possibly use OCB or GCM for 1 pass authenticated encryption. –  Richie Frame Oct 9 '13 at 10:18
"HMAC-SHA256 with the content's encryption key" - naughty. Never use the same key for two different crypto primitives. Upon completion of your PBKDF2 rounds, perform a final round, but ask for 512 bits of output. Use the first 256 bits for the encryption key, and the rest for the HMAC key. More info here. As mentioned, if it's available, authenticated encryption such as CCM, EAX, GCM or OCB is also a good option. –  hunter Oct 9 '13 at 12:41
@hunter one has to be careful about that. If one directly requests more than the natural size from PBKDF2 it can increase the cost for the defender but not for the attacker. Personally I like HKDF-Expand for this step. –  CodesInChaos Oct 9 '13 at 13:42
I would also store the number of iterations in the file (that was used for this particular file), in case you will change it later on. Later files will be encrypted with higher number of iterations, but the older files can still be decrypted. For that matter other non-secret parameters can be stored for backward compatibility as well, such as PBKDF2 hash function used etc. –  Kliment Mamykin Dec 19 '13 at 17:22
show 4 more comments

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.