So I am developing an iOS & Android Application where a lock screen is used for authenticate a user.

There are 4 options to unlock the screen: Password, biometric, pin code and nothing.

I wanted to ask someone with better experience than me about my solution for the pin code process.

There process is following:
User choose pin -> pin is hashed with: PBKDF2(pin, salt, {keySize: 512 / 32, iterations: 1000}) The 32 first bytes from the hashed pin and the 16 following are used as Key & IV for AES-256 encryption.

So I am basically encrypting my local database encryption key through following:

AES.encrypt(realmKey, pinKey, { iv: iv })

I am then storing the encrypted key & the pin's saltin Keychain/Keystore.

My question is regarding if this is a secure way of doing this. I know that using pin code isn't the best solution I am not recommending it for my users but I stil want to include the option for those who want it and I want to minimise the risk of attack as much as possible.

I first thought this was a good solution, but I was later on thinking that the user basically enters the pin and the pin is then run through the code (hashing with the salt) and decrypting the key automatic in the app. Wouldn't this be easy for a hacker to crack by simply trying all possible combinations ? or do you believe this is a good way ?

I would appreciate any advice and feedback on this

  • 1
    $\begingroup$ What is the pin code size? pin codes are usually referred a few digits and that is dangerous. You are relying on the salt's randomness and security. You should teach your users the dicewire password generatation. $\endgroup$
    – kelalaka
    Feb 24 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.