3
votes
2answers
184 views

Using PBKDF2 twice with different argument order

I'm pretty sure this is a really bad approach (in theory), but one of my clients is doing this and I was wondering… How bad it is to perform pbkdf-2 in this way (with 2000 iterations)? ...
3
votes
2answers
231 views

Encryption Key derivation from numeric PIN?

I want to store data encrypted within an Android application. Keeping an encryption key safe outside the app is not an option so I looked into password derived key algorithms. I found a nice example ...
1
vote
2answers
275 views

How terribly flawed is this design for key storage?

Dave here, with a plan for storing secrets. Threat model: Database and keyfile may (will?) be stored on un-trusted servers. Database contains many valuable secrets (passwords), encrypted by key ...
3
votes
1answer
382 views

Can I secure my key by XORing it with a hashed password?

I'd like to build a simple password-protected symmetric key system. The key-creation process in my system operates as follows: The system creates a 256-bit key purely at random. The user chooses a ...