Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I'd like to combine a random key file with a password to generate a secure seed for a CSPRNG. The key file is assumed to have very high entropy, but the password will be whatever the user provides. What's the best way to combine the two in order to seed the PRNG? The goal of course is that the output of the PRNG will be difficult to predict unless you have both the key file and the password.

My first thought it to simply use PBKDF-2 to stretch the password so it's the same size as the key file, then XOR them together. I won't be transmitting this seed or anything, so I don't think it matters that this in itself is poor encryption. But are there any other considerations I should make?

I will most likely be using AES in counter mode for the PRNG, but an answer covering a more generic case would be appreciated. Also, I'm assuming that the key file is the same size as the seed that the PRNG will take.

share|improve this question
1  
What size seed does the CSPRNG take? –  mikeazo Oct 24 '12 at 19:05
    
Good question. I guess I've been assuming the key file is the same size as the seed, which I think will be a fair assumption for this application. –  sh1ftst0rm Oct 24 '12 at 19:50
add comment

1 Answer

up vote 3 down vote accepted

If your password has a low entropy (or "could have a low entropy") and the "key file" is assumed to be known to an attacker, you really need some key stretching like PBKDF-2, bcrypt or scrypt with a suitable work factor to detain possible attackers.

As these functions also have a salt input, and you actually have another entropy source (the key file), I would use the key file as the salt input and the password as the key input to these schemes, and produce an output of suitable size for your CSPRNG seed.

I suppose the same scheme is also secure when only the password is known (and not the keyfile used as salt), though this is not a direct design goal of these password hashing schemes.

share|improve this answer
    
Thanks, nice simple idea. –  sh1ftst0rm Oct 26 '12 at 12:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.