I am trying to implement a password manager in C and I had a question about the proper steps in implementing the crypto. I looked at some implementations, google talks on crypto and what the standards are.
so I just wanted to list out the steps in the program and I wanted to make sure I was doing it right.
- If its a first time the program is being used, it will ask the user for a password to use
- This password will then be hashed with some algorithm (SHA1?) and then stored in a file
- Then a password storage file is created and the user can add, delete or view the entries
- When the user is done, the password storage file is encrypted (use the user password as input to openssl, openssl aes-256-cbc -salt -in test.txt -out test.aes, this is from the command line...I'd have to do the equivalent in C)
- when the user reopens the application, the user password is checked against the stored hash
- if it passes, the password is sent to openssl to decrypt the password storage file
- the user does some stuff and exits, the password storage file is reencrypted
So what do you guys think? Let me know if there are C specific crypto resources I can use. Thanks for your help!