Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If I'm using PBKDF2 to stretch a password into a suitable key for use in encryption with AES, should I be using a random salt (for PBKDF2, not the AES IV)?

share|improve this question
    
You can leave out the AES IV if you use a per-message salt. But you should not leave out the salt even when you use an IV. –  CodesInChaos Dec 12 '13 at 15:03

2 Answers 2

up vote 2 down vote accepted

Absolutely! It's even right there in the PKCS #5 v2.0

A salt in password-based cryptography has traditionally served the purpose of producing a large set of keys corresponding to a given password, among which one is selected at random according to the salt.

By using a secure salt, password p1 = tomato will not produce the same key as p2 = tomato even though they're the same password. This has two benefits:

  • Protection against rainbow tables.
  • Only one password can be attacked at a time. The same computational effort can't be utilized to "reverse" more than one password.
share|improve this answer

You must do this, as otherwise two users using the same password twice will generate the same key. The effort of using a salt is almost none, yet increases your security.

Please refrain from rolling your own there is a standard and you should use it!

It's healthy to question the "whys" from a learning perspective but playing with crypto and trying to cut corners can be dangerous if you are not an experienced cryptographer.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.