I want to preface this by saying i will not be using any of this code/information in a live project, this is only for learning/fun (so I welcome some speculation)
I was looking at how the PHP crypt() function works, and i had an idea. crypt() prepends a few characters at the start of the hash it creates that convey information about how the hash was created (algorithm used, number of rounds, etc...). This gives a beneficial side effect of being able to check if the hash was created up to a certain standard (check if it was hashed with a minimum amount of rounds) and rehash it if it was not.
I had the idea to use this idea for symmetric key encryption (AES128) as well. It would allow me to very simply enforce a "minimum security level" that i can increase at any time and run on my entire database, and it will re-encrypt any data that does not meet the standards. Changing cipher, salt-size, hashing algos, rounds for PBKDF2, etc. will be much easier to do and much faster to implement, the only thing that would be kept secret is the key.
The exact data i wanted to include is:
- Salt Size
- MAC Size
- Number of rounds used for PBKDF2
- The hashing algorithm used to create the MAC (ex. SHA512)
- The hashing algorithm used for PBKDF2 (ex. SHA512)
- The cipher algorithm used in the encryption (ex. AES128)
- The mcrypt mode used in the encryption (ex. CBC)
Essentially the hash would look like
So please, tell me why I'm stupid!