I have a function that derives two sub-keys from one passphrase using PBKDF2 one which is used as a encryption key the other for HMAC generation, because these two sub-keys will need to be regenerated when the user wishes to decrypt there file so the salt used and the number of iterations must be available to the client and I am wondering whether it would be a massive security risk to simply store them in the cipher text or somewhere on the users machine?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
The reason we add salts to the key derivation process it to make the key hash image unique for a given password. Actually a salt is added to remove weakness when an attacker has a list of "most common password". Adding a salt make the attacker job harder, he has to rebuild the attack per every salt he finds, i.e.: per every ciphertext he gets. It is considered safe to store the salt with the cipher text.
Similarly the iteration number is there to slow down a brute force attack, so it is still safe to store it with the cipher text.