1
$\begingroup$

I want to create a key for my realm database wich work with AES-256 and for encryption wants a byte[64] key.

I read this good question about create a key from 4 digit number: “Encryption Key derivation from numeric PIN?”, and this good article about hashing security: “crackstation.net : Salted Password Hashing - Doing it Right”.

I understand that a salt is some random string that creates every time user change their pass or login. But where and how should I save the “salt” string?

The article mention above states…

The salt should be stored in the user account table alongside the hash

…but my database is what I want to encrypt.

Improve this question
$\endgroup$
7
  • $\begingroup$ A salt has nothing to do with symmetric encryption. It's unclear why you even think you need a salt for anything to begin with. $\endgroup$
    – Stephen Touset
    Jan 12, 2017 at 10:59
  • $\begingroup$ realm for aes256 need a key and key must be byte[64] for generating this key I have a 4 digit pin that user give it to me.for generate the key by suggesting below link I need a salt too but where should I save this salt? android-developers.googleblog.com/2013/02/… $\endgroup$
    – max
    Jan 12, 2017 at 11:34
  • 1
    $\begingroup$ The salt can be public. $\endgroup$
    – 111
    Jan 12, 2017 at 12:08
  • $\begingroup$ @111 can you please explain more. if salt can be public so what are reasons to create it? article I mentioned above said we create salt because it provides save two same passwords with different hash code which make it hard to attacker to extract pass from the hash if the attacker can find salt so what's point of created at first? $\endgroup$
    – max
    Jan 12, 2017 at 12:35
  • $\begingroup$ See stackoverflow.com/questions/420843/… . In your case maybe you can avoid using a salt. $\endgroup$
    – 111
    Jan 12, 2017 at 12:40

1 Answer 1

Reset to default
1
$\begingroup$

I want to create a key for my realm database wich work with AES-256 and for encryption wants a byte[64] key.

AES doesn't work with 64 bytes of key (in all the main modes of operation anyway, I'm excluding SIV mode here). There are 3 key sizes: 128, 192 or 256 bits, which obviously require keys using 16, 24 or 32 bytes of (semi-random) key data.

I understand that a salt is some random string that creates every time user change their pass or login. But where and how should I save the “salt” string?

A salt is mainly used for Key Derivation Functions, in particular Password Based Key Derivation Functions. The salt can remain public. One common method is to simply prefix the salt to the ciphertext (i.e. the encrypted database in this case).

But first you need to decide if you require a key or a password as input. If it is a key you don't need a salt. You may however require an IV - which is almost but not quite the same thing. For the IV the same thing goes, you can simply prefix it to the ciphertext.

Generally the size of the salt / IV is static, so it is easy to retrieve / remove it without requiring a specific encoding.

Improve this answer
$\endgroup$
1
  • $\begingroup$ I don't know about AES key sizes but in realm example shown in below link you can see an example of usage which uses 64 bytes as key but about salt I still can undrestand porpose of usage of salt if its just prefix of ciphertext. my knowledg of salt is artile i mention and based on that we should save salt somewhere secure github.com/realm/realm-java/blob/master/examples/… $\endgroup$
    – max
    Jan 12, 2017 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.