1

I am currently working on a cli application which uses AES encryption. For key generation, I am using the PBKDF-2 algorithm, along with SHA-256. I am providing a way to enter the password once and store the key, to enable the user to use the application multiple times without entering the password, till he decides to remove the key and the password needs to be provided again.

I am currently storing the key in a file, and deleting it once the user decides he is done. I believe this is insecure, as other processes may use that file, and that furthermore, deleting files doesn't really delete the data in them.

What is the best way to solve the above problem? One way is to run the process on a loop, removing the need for password storage, but I want to know if there is a way to securely keep the key across processes.

Improve this question
1
  • This problem is similar to the problem that developers of web servers (such as apache and nginx) face, where private keys for SSL/TLS must persist for long durations of time. Ideally, a hardware based HSM should be used. These ensure that the private key never leaves the HSM. But, if an HSM is not feasible for your application, then you might want to consider using a keystore. See digitalocean.com/community/tutorials/… for more info.
    – mti2935
    Feb 19, 2022 at 12:38

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .