I'm working on a simple file encryption tool.
Basically, here's how my program works:
password = get_user_typed_password() salt = uuid4() key = bcrypt(password + salt) cipher = AES(key) for block in input_file: output_file.write(AES.encrypt(block))
My question is about "how could I make a possibly short and weak password a long and strong one?".
I thought I could use a concatenation of sha512 hashed, like that:
for i from 1 to 1000: password += sha512(password).digest()
At the end, I would have a a 64000 long password with 'high ANSII' characters like these ones: ☼¢♣┌¥↕▼║ÅÕ¼■♫.
Do you think it's a good idea to stretch the given password like this? Remember that it will not be stored in a db.
I know that inventing your own mechanism is bad, but here, it's only for making the password longer/stronger...the final key will be key = bcrypt(long_password + salt) anyway.
With that question, I wanted to ask one that I didn't found here: "Hash concatenation is bad for generating a key...but what about password stretching?"
Thanks in advance for your answers, explainations and critics (I'm a newbie in crypto)!