Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Title says all; Is it safe to hold key file's hash (MD5 or SHA1) in application (hard-coded)?

Thanks

share|improve this question
4  
It looks like we need some more context: What type of key do you have there, for what do you use it, for which goal do you want to hard-code a hash of it? –  Paŭlo Ebermann Oct 13 '12 at 22:51
    
@PaŭloEbermann: AES key, Encrypting/Decrypting files that application works with (also application configuration file); for #1) identifing it on a USB storage #2) being sure that it is my key –  4r1y4n Oct 14 '12 at 7:03
    
If you can hardcode a hash of the key into your application, why can't you just hardcode the key itself? –  Ilmari Karonen Oct 15 '12 at 11:44
add comment

1 Answer

The only danger is that the application now holds a fingerprint of your key. Thus enables the possibility to do some attacks, like bruteforce, and something to check against. And so it really comes down to the "same old question" as of how to keep your password-storage safe. If the key-file is a large one and somewhat random, then bruteforce is most certainly out of the feasible picture, however if it's not or the key-file is a common file or just a text-file containing a common word, the attack methods doesn't differ that much from what every webapp developer is trying to secure.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.