I have what I hope are some basic crypto questions.
- encryption vs. keyed hashing - If I'm interested in confidentiality, data integrity, and authenticity for stored files, can I just use symmetric key encryption and not any form of hashing?
- password/salt vs. key/iv - Let's say I don't require a user to enter passwords, and instead a program is doing the encryption and decryption. Is there a drawback to using a key/iv without salt, where the key/iv is derived from a strong password? I've read about the benefits of something like PKCS#5 password based key derivation, where there's salt to add entropy and iterations to make it even harder to guess. That seems like it would help prevent rainbow table attacks against weak passwords, but what if I could guarantee a strong password, am I missing anything by not using salt and iteration?
- key storage - Are there any best practices for storing symmetric keys in software? In my code, they're easy to find assuming you have access to the source code. I'm wondering if there's a way around this, without resorting to a hardware module.