# Password protection of encryption and signature keys

I would like to store encrypted backup of text files on my computer. I'm developing a python script using Pycrypto to achieve that, based on this code to use the library. (current code)

The basic idea is :

1. Generate new/Read existing AES + signature keys
2. Encrypt the data using the first key (AES 256-CBC)
3. Sign the encrypted data using the second key with HMAC-SHA256

The generation of bytes for the keys is simply the result of `Random.get_random_bytes(KEY_SIZE + SIG_SIZE)`, so 64 bytes in my case.

Now, to improve the security, I would like to add a password protection to the key (if somebody find the keys file). My initial idea is to hash salt+password and XOR the result with the random bytes in the key-file.

If I use SHA256 (to be consistent), it means I output 32 bytes and should XOR twice (for each 32 bytes key) and I don't like that (not sure but sounds like a potential attack). Using a different salt for each key ?

Finally, is there a standard way to store the salt and keys ? I don't like the idea of inventing my own scheme (usually a bad idea in cryptography). Is there some good practices ?

Update: thanks to the answer of Polynomial, I got the following code :

``````from Crypto import Random
from Crypto.Protocol.KDF import PBKDF2

rand_bytes = Random.get_random_bytes(enc_key_size + sig_key_size)
# save the salt
with open('keys.salt','w') as f:
f.write(rand_bytes.encode("base64").replace("\n",""))
# derive the two keys using PBKDF2
return (ency_key, sig_key)
``````

For example, if I know that the first byte of plaintext is always `0x4B`, and I can see that the first byte of ciphertext is `0xC7`, I can compute `0x4B ^ 0xC7` and get the first byte of the key, which would be `0x8C`. From there I can skip ahead 32 bytes and decrypt that byte of ciphertext, and again, and again. Using that information I might discover more information about your plaintext, and use that to decrypt more of the data.