I'm developing a system that manages and shares user passwords (which are encrypted using user generated symmetric keys). But of course a big concern is the user losing their symmetric key and the data becoming unrecoverable.

Which has led me to thinking about a system generated symmetric key. So that the user merely authenticates him/herself and it is the system that possesses the key (or knows how to generate the same key) and decrypts and sends the data.

I guess my question is: If this were open source, and everyone can see the code, (so it won't work that I have some seed hardcoded) is there any conceivable paradigm in which a system can generate a key, not store it (for security reasons), but be able to reproduce that same key, without anyone who has open access to the code learning what the key could be?

Even reading it now it sounds too good to be true, but I figured I'd ask anyway.

Thanking you in advance, Jeffrey

2 Answers 2


Nope. Symetric keys must be random. If you want to make the key recoverable, store it somewhere, or use some other recovery option. But don't generate it using some predictable algorithm or the whole system falls apart.

Storing the key is far safer than generating it using a predictable system. Because when someone knows your system, then they have all the keys you'll ever generate.


Have you considered encrypting the whole database instead? Something like Transparent Data Encryption (TDE). You can read http://en.wikipedia.org/wiki/Transparent_Data_Encryption and http://msdn.microsoft.com/en-us/library/bb934049.aspx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .