I'm trying to implement a password manager and I want to achieve this behaviour.

  1. User enters a master password once (eg. when the program is first run) and a key/hash of some sort is derived and stored (from which the original password cannot be recovered)
  2. User can then choose to store data in the password bank eg. store --id=myid --data=datatoencrypt. This data is encrypted using AES without having to prompt for a password using the stored key from step 1

At this point the encrypted data stored cannot be recovered without the original password, but new data can be added without the original password

store get --id=myid
Please enter your password: *******
The data is: datatoencrypt

I hope this makes sense. Any pointers on how I can achieve this? (I'm guessing a combination of asymmetric and symmetric encryption

  • 1
    $\begingroup$ ... I really hope this is not meant to compete with password managers like KeePass in terms of security? $\endgroup$
    – SEJPM
    Commented Sep 7, 2016 at 18:31

1 Answer 1


Wouldn't this be just the usual asymmetric encryption, as if you were encrypting e.g. email with GnuPG?

Create a private key, store it password protected (this is your master password). Anything you need to save, encrypt using the corresponding public key (no need for a password). But only the private key can decrypt your data items, and you need to enter the password to use that.

  • $\begingroup$ Thanks, turns out I've been overthinking this. My plan was to use AES for the actual encryption since it's significantly faster and use an asymmetric encryption for deriving the AES key but now that I think about it it's not possible because AES is symmetric $\endgroup$ Commented Sep 7, 2016 at 17:15
  • $\begingroup$ @ᴘᴀɴᴀʏɪᴏᴛɪs Combining symmetric with asymmetric encryption is quite standard, as it is done in all the standards for email or file encryption. It's called hybrid encryption $\endgroup$
    – tylo
    Commented Sep 9, 2016 at 10:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.