1

I'm working on updating the encryption method of a class at work. The encrypt and decrypt methods take the text to encrypt/decrypt and a string which used to be used as a salt (this string is hardcoded in the method calls in lots of places throughout the code base).

My plan is to securely generate a random 16-byte salt, then use scrypt to derive a 64-byte array from the salt and the string (which I'm now considering a password since it's not being used as a salt anymore).

I'll then split that array into two 32-byte keys, and use the first to encrypt the text with AES-GCM. Then I'll use the second key to encrypt the first and append the encrypted key and the salt to the encrypted text.

On decryption, I'll regenerate both keys using the salt appended to the encrypted text, decrypt the key appended to the encrypted text, and compare it to the generated key. Assuming they're the same, I'll then decrypt the text and return it.

Am I gaining anything by using two keys like this, or would it be just as good to derive a single key from the salt and password, and just append the salt to the encrypted text?

Improve this question
1
  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
    – Community Bot
    Sep 15, 2021 at 0:14

1 Answer 1

Reset to default
0

Is there any benefit to encrypting a derived key?

Not really.

Also, the overall scheme seems like a strange idea and a bit confusing. It seems like you are changing the encrypt/decrypt scheme so that the password is just a bit more obfuscated. But it would be better to just make the password secret... since the password is supposed to be secret. Is there some reason the password can't just be a protected secret?

Also, is the "salt" supposed to play the role of the initialization vector (IV)?

Improve this answer
2
  • No, the salt is clearly for Scrypt. The OP didn't mention the IV of the AES-GCM and not clear what they know about the (key,IV) pair reuse problem of AES-GCM. They need to use AES-GCM-SIV.
    – kelalaka
    Sep 15, 2021 at 20:59
  • Yeah, but he also needs an IV and has already generated "a random 16 byte salt." And he is storing it with the ciphertext as you would store an IV. So, I'm wondering if he is using it for the IV.
    – hft
    Sep 15, 2021 at 21:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .