I am building an Android app that will run purely locally on the user's device, no servers. It has a database that I want to encrypt with the user's password, which requires a 64 byte key. I've considered these 2 ways:
- Use bcrypt, but that doesn't give me 64 bytes
- Use SHA512 which is much faster to brute-force
The problem with both is that I don't have a reliable place to store a random salt. The "attack scenario" would be someone pulling the database file off the phone and using a rainbow table to decrypt.
- add a static salt anyway?
- use bcrypt and just fill the missing bytes with 0s, because it's more important that generating a rainbow table be hard?
- use SHA512?
- something else entirely?