Should an AES byte key generated with OpenSSL be converted to hex?

Question

I am generating a key & iv with Ruby's OpenSSL wrapper for an AES CBC 256 setup:

cipher = OpenSSL::Cipher::Cipher.new('aes-256-cbc')
key = cipher.random_key
iv = cipher.random_iv

I am then storing the generated key / iv in blob columns in the database. When trying to display the key or iv it looks something similar to this:

×>×=ñ±8i·ÊahJ[  }öú­Ç{xÎÝ¿

My question is:

should the key & iv which seem to be random bytes be converted to hex with an SHA function before using and storing into the DB?

Is it safer this way for storage / use or can they be used just as they are generated in byte form?

UPDATE:

Looks like I was mistaken on my terminology and use of SHA.

Revised question: Is a random byte key from OpenSSL just as random and secure if I convert it to hex via unpack('H*')

Any help is appreciated.

Thanks!

Answer 1

This is an answer to your revised question, although it doesn't seem to make any more sense:

Hex is just another way to represent your data. It is neither more nor less secure than the binary representation or any other representation. Its all about convenience when dealing with this numbers.

As humans we tend to operate with data encoded in the decimal system. Computers on the other hand operate with binary data. However, the problem with binary data is that it tends to get quite long and error prone when you as a human have to deal with it. It is much more easy for us to remember or copy 46 rather than 0b101110.

The hex representation is a a good compromise, because:

• A single character encodes four bits, therefore making it shorter than the appropriate binary representation.

• It is quite easy for humans to handle. Basically everyone is used to 0-9 and A-F.

• Is is really easy to convert data from binary into hex and vice versa.

• It can be represented in ASCII without any problems. Random binary data on the other hand looks like complete gibberish and gets messy because of different encodings and such.

Yet, at the end of the day it is all representing the same information.

Answer 2

The reason why you see this gibberish is that the key is random and simply interpreting it as a string of characters doesn't make sense and can lead to all kind of mistakes.

You should inform yourself about hashes! Once you hash something, you are not able to retrieve the original value, so I would guess you don't want to do that. Hashes are not about converting data into hex! Its just convenience that hash functions usually output hex strings, because they can be handled more easily.

What you might want to do, is to convert the key into its hex representation. Note, however, that this is something completely different than a hash function. I'm sure Ruby offers you means to do that.

Besides all of that: Why are you storing keys and IVs in a database? Obviously we don't know anything about your application, but this seems like a bad idea, especially with a lack of understanding for cryptographic fundamentals.