Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm developing a system that manages and shares user passwords (which are encrypted using user generated symmetric keys). But of course a big concern is the user losing their symmetric key and the data becoming unrecoverable.

Which has led me to thinking about a system generated symmetric key. So that the user merely authenticates him/herself and it is the system that possesses the key (or knows how to generate the same key) and decrypts and sends the data.

I guess my question is: If this were open source, and everyone can see the code, (so it won't work that I have some seed hardcoded) is there any conceivable paradigm in which a system can generate a key, not store it (for security reasons), but be able to reproduce that same key, without anyone who has open access to the code learning what the key could be?

Even reading it now it sounds too good to be true, but I figured I'd ask anyway.

Thanking you in advance, Jeffrey

share|improve this question
up vote 1 down vote accepted

Nope. Symetric keys must be random. If you want to make the key recoverable, store it somewhere, or use some other recovery option. But don't generate it using some predictable algorithm or the whole system falls apart.

Storing the key is far safer than generating it using a predictable system. Because when someone knows your system, then they have all the keys you'll ever generate.

share|improve this answer

Have you considered encrypting the whole database instead? Something like Transparent Data Encryption (TDE). You can read and

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.