Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a function that derives two sub-keys from one passphrase using PBKDF2 one which is used as a encryption key the other for HMAC generation, because these two sub-keys will need to be regenerated when the user wishes to decrypt there file so the salt used and the number of iterations must be available to the client and I am wondering whether it would be a massive security risk to simply store them in the cipher text or somewhere on the users machine?

share|improve this question
up vote 0 down vote accepted

The reason we add salts to the key derivation process it to make the key hash image unique for a given password. Actually a salt is added to remove weakness when an attacker has a list of "most common password". Adding a salt make the attacker job harder, he has to rebuild the attack per every salt he finds, i.e.: per every ciphertext he gets. It is considered safe to store the salt with the cipher text.

Similarly the iteration number is there to slow down a brute force attack, so it is still safe to store it with the cipher text.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.