0
$\begingroup$

I built a system that allowed users to generate an unlimited number of email addresses.

Instead of storing each one in a db, I created addresses dynamically and made the address an hmac signed message with the shared secret being the bcrypt hashed version of their account password. e.g. 1948417:11eea538fdc926e38ff97689d913d34da152b072@example.com

Security wasn't critical and it worked pretty well, but I'm considering using the same strategy for something a little more delicate.

So, the question is... Is using a hashed password as the shared secret a good idea or bad idea?

$\endgroup$
1
$\begingroup$

I'm not sure about your specific system; this only addresses "can a key derived from the password make a good shared secret?"


The most common password hashing functions are actually designed for exactly this purpose -- deriving a cryptographic key from a (weak) password. That's actually what PBKDF2 stands for: "password-based key derivation function #2" (scrypt and bcrypt don't have it in their name, but are also key derivation functions). It's also used in GPG, and for file and disk encryption, etc. Kerberos does so as a login mechanism - when you send the KDC your username, you get information that lets you authenticate as that user, encrypted with a key derived from the user's password.

Passwords tend to be low-entropy, far below that required of a cryptographic key. PBKDFs mitigate that by having a salt (to prevent dictionary attacks, for instance by having a list of the keys derived from the 10000 most common passwords) and by being as time-consuming as you please, which means that while an attacker doesn't have to try as many possibilities as with a random key, it takes them a long time to try each possible password.

So in general, password-derived keys make fine shared secrets. There are some catches (notably: if an attacker compromises them, they've compromised the shared secret; this is why Kerberos KDCs have to be so secure). But there's nothing generally wrong with the concept.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.