I am trying to Use AES to store passwords for a password manager. For authentication I am already using bcrypt. As AES uses 256 bit Key can I use SHA256 to generate 256 bit key from hashed value of bcrypt(Not talking about hash saved in Db).

  • 2
    Why Bcrypt? Not Scrypt or better Argon2id?? – kelalaka Feb 3 at 17:10
  • What "hashed value of bcrypt" are you talking about, if not the "hash saved in DB" (presumably the hashed password)? – gowenfawr Feb 3 at 20:00
  • It's unclear what you're asking. Are you building the password manager? If so, are you trying to figure out how to manage the data encryption key? – Xander Feb 3 at 21:30
  • Yeah, I am thinking of using bcrypt and sha256 for generating data encryption key for Password manager @Xander – Nischal047 Feb 4 at 4:09
  • I have planed to use bcrypt for authentication and for generating data encryption key@gowenfawr – Nischal047 Feb 4 at 7:39

First things first: AES is a standardized subset of the Rijndael cipher, which supports 128, 160, 192, 224, and 256-bit key sizes (AES restricts that to 128, 192, and 256, and also fixes the block size to always be 128). So you don't need to use 256 bits at all; you can, if you want to, but 128 and 192 also work even without stepping outside of AES per se and back to Rijndael.

Since key stretching (hashing a weaker key with an algorithm that produces a longer digest) doesn't add any entropy and therefore probably doesn't impact the security at all, you can either skip it (use AES-192 on the raw output of bcrypt) or you can use it (SHA-256 or even SHA3-256 hash the bcrypt output and then use AES-256). The only place I can think of where using a stretched key might be more secure is if quantum computing ever takes off, brute-forcing a 256-bit key might be enough harder than brute-forcing a 192-bit key to make a difference, but in that situation (actually, in most situations) the easiest option by far would be to just brute-force the password being fed to bcrypt.

Two other obligatory questions:

  1. As @kelalaka asks, why use a 22-year-old password hashing algorithm, that only allows tuning the compute cost and has (by moderns standards) a very moderate memory cost, when newer algorithms that allow tuning both are available?
  2. Why are you building your own password manager to begin with? There are so many options, both proprietary and open-source, most of which have been subjected to extensive review and stood up to actual field usage. Rolling your own cryptosystem isn't quite as bad an idea as rolling your own primitives, but it's still not a good idea. If you need to ask when or how to (safely) do key stretching, you might create a password manager as an interesting project, but you should think at least twice before actually storing any sensitive passwords in it.
  • Thanks for explaining. I am new to this and I am trying to build Password manager for learning. It is for personal project. And about using bcrypt, I was already using bcrypt for my old project for todo app. I am trying to extend that. – Nischal047 Feb 4 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.