Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently I am developing an application that stores and reads encrypted data. The data is encrypted with AES and the actual AES key is derived from the users password (and some nonce) with PBKDF2 with many rounds (taking 500ms on my Intel i5-3570).

I want to use the keychain (like available in Mac OS or some other pendant like keyring in Linux) to store the information needed to access the users data. My assumptions on the keychain are:

  1. The keychain is strongly encrypted and hence can be considered secure
  2. The keychain might be synchronized to the internet (like Apple allows to synchronize the keychain with iCloud)

I see two possible solutions:

  1. Store the users password in the keychain
  2. Derive the AES encryption key and store that in the keychain

My question is, which one is better both from the security standpoint and in general (if there is a general answer)? I guess solution 2 is better because of two reasons:

  1. The user password has not to be stored at all (even if the keychain is itself encrypted again, I find the user password deserves more protection than the derived AES key, since the user password might be used for some other accounts)
  2. Accessing the encrypted data is faster, since the slow task of deriving the AES key must only be done once

Is there anything I missed?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.