I'm using this codereview sample to encrypt data. I would like to provide hardware protected encryption and a user password as the key.

Is it acceptable to XOR the KDF Pkcs5S2 in Bouncy Castle with a device generated random key?

Is the resulting XOR key more secure than the KDF output?

*note the BouncyCastle PKCS5S2 implementation uses SHA1 as the HMAC calculation function if that matters.

  • $\begingroup$ Note well: hardware protected encryption usually means that the key remains in secure hardware (aka usually not your CPU) and any user input normally is directed to this hardware for access authorization. $\endgroup$ – SEJPM May 14 '16 at 22:22
  • $\begingroup$ @SEJPM Thank you for that terminology & clarification. Looking into the Apple Secure Enclave, I'm limited to certain functions that doesn't allow access to the raw key material. Still, I would like to know if I can combine keys, albeit with a different description (assistance appreciated) $\endgroup$ – halfbit May 14 '16 at 23:07
  • $\begingroup$ As for the key combination I would suggest making use of the hardware enforced keys. Take any deterministic function whiches key resides in hardware and input the user password / some derived value of that password to that function. Use the result as the encryption key. (Note: I assume here something like AES-ECB, HMAC, ...) $\endgroup$ – SEJPM May 15 '16 at 10:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.