118 reputation
5
bio website juicycocktail.com
location Europe
age 29
visits member for 1 years, 11 months
seen May 21 '12 at 10:35
Chief Sucker at Juicy Cocktail.

Jan
13
awarded  Popular Question
Jul
21
awarded  Student
May
14
awarded  Scholar
May
14
accepted Can the salt for PBKDF2 be a hash of the user-entered password?
May
14
comment Can the salt for PBKDF2 be a hash of the user-entered password?
In the first case I wouldn’t store the salt, because it could be derived from the password the user entered. This smells like security through obscurity, though. So is it OK to store the salt for PBKDF2 alongside the encrypted key and IV, let’s say in a separate field of a table or as a header to the encrypted key? We’re talking about a single-user multi-client application that in most cases will store only one encrypted data key.
May
14
awarded  Supporter
May
14
asked Can the salt for PBKDF2 be a hash of the user-entered password?
May
14
awarded  Autobiographer