3
$\begingroup$

I'm using libsodium to create public/secret key pairs from a password and salt combination by using crypto_pwhash_scryptsalsa208sha256 to generate a seed and passing that seed to crypto_box_seed_keypair.

Is it safe to recreate the key pair using the password+salt every time I need to use it so I don't have to store the keys (encrypted or not) anywhere in the system?

I would store the salt, and ask for the password again every time it is needed.

Improve this question
$\endgroup$
1
  • $\begingroup$ Store the salt, and ask for the password again every time it is needed. $\endgroup$
    – Mauricio de Souza
    Apr 21, 2016 at 13:15

1 Answer 1

Reset to default
1
$\begingroup$

Is it safe to recreate the key pair using the password+salt every time I need to use it so I don't have to store the keys (encrypted or not) anywhere in the system?

The problem with that is that your public key then effectively becomes a password hash, meaning anyone who sees it will be able to mount a dictionary attack on your password to generate the private key that corresponds to it. They will need access to the salt for the attack, of course, so in that case your salt effectively becomes a secret.

So there is not really a great difference to storing an encrypted (random) private key vs. storing a (random) salt that allows deriving the private key. However, when deriving the key directly from the password you should use a strong random number as a salt, not something unique but guessable, like a timestamp or an email address.

Improve this answer
$\endgroup$
4
  • $\begingroup$ "storing an encrypted (random) private key" means you don't need to spend time running the key generation algorithm, which lets the pbkdf's work factor be higher for a given overall runtime. ​ ​ $\endgroup$
    – user991
    Apr 21, 2016 at 21:05
  • $\begingroup$ @RickyDemer, yes, but by deriving the key directly from the password the attacker needs to run the key generation algorithm in their dictionary/brute force attack, so it's not really any worse. $\endgroup$
    – otus
    Apr 22, 2016 at 5:49
  • $\begingroup$ Public Key key generation algorithms are not designed to not allow shortcuts, and it seems to me that for RSA, one can test given randomness against a given public key with fairly high accuracy significantly faster than running the key generation algorithm. ​ (Use Baillie–PSW and only generate one of the primes.) ​ ​ ​ ​ $\endgroup$
    – user991
    Apr 22, 2016 at 6:12
  • $\begingroup$ @RickyDemer, the PK algorithm here is Curve25519 (in crypto_box), so even if there's a shortcut the time saved is minuscule compared to decent scrypt parameters. For other combinations of algorithms that is a valid point, though. $\endgroup$
    – otus
    Apr 22, 2016 at 6:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.