I am new to this and want to ask a basic question. Suppose I used my password (say "ABC123")
to generate a key using the PBKDF2 algorithm (or any such algorithm). For encrypting a file I'll
input my password and a key will be generated. This key will be used to perform encryption.
Now, suppose if I want to decrypt the same file, I have to enter the password ("ABC123") again.
The key will be generated again to do decryption.
My question is, will the keys generated during encryption and decryption be same?
Add a comment
|
3 Answers
PBKDF2, as the name suggests, is a key derivation function. It means that the algorithm takes some parameters (including a password since it is a password based key derivation function) and produce a key of arbitrary length. Even if PBKDF2 is expecting some random values as parameters (for instance, the salt), when you pass the same parameters to the function, it always returns the same key.
It means also that when you are using PBKDF2 to encrypts a file you also have to store all parameters (i.e. for PBKDF2: the Pseudo-random function, the salt, the number of iterations, the length of generated key) along with the encrypted file. Indeed, these parameters will be necessary to recompute the same key from the same password when decrypting the file.
-
Hi @Jcs thank you for answering.As you said, "parameters have to be stored in the encrypted file", isn't it is easy to parse the encrypted file and get the parameters? Once we have the parameters we can launch the brute force attack.– tausifCommented Mar 9, 2014 at 15:42
-
I said "encrypted file" but maybe "encrypted data" is a better term. I mean, even with the password, the encrypted data (i.e. the cipher output) does not contain itself all required information to be decrypted. The algorithm parameters are also required such as the IV for a symmetric cipher, the PBKDF2 salt or iteration count... Of course, a file encryption software should gather all these information along with the encrypted data into the "encrypted file".– JcsCommented Mar 11, 2014 at 12:33
PBKDF2 generates a pseudo-random key from a password. The difference between pseudo-random and random is important because a random key would have to be stored and recovered while a key generated from a password using PBKDF2 can be generated (or "derived") any time you have the original password (and salt). You can't simply re-generate a truly random key because a random process will not reliably generate the same output, ever.
And yes, you use that same key for encryption and decryption assuming you are using a symmetric key encryption method.
-
Hi @Slartibartfast could you please explain me difference between pseudo-random and random in detail.How it is not possible to re-generate the true random key while same is not true for pseudo-random?If u can give me some link to blog or previous post on the topic it would be helpful to me.– tausifCommented Mar 9, 2014 at 15:46
-
A pseudo-random process generates the same output if provided the same input, but usually isn't very predictable from prior outputs. Truly random doesn't use a seed and isn't predictable, Link: superuser.com/questions/712551 Commented Mar 9, 2014 at 18:18
This depends on the type of encryption. It sounds to me like you're looking for Symmetric-key cryptography. As you've said, one password encrypts and decrypts.
I would recommend reading up on some popular algorithms to find out how they do this. Such algorithms would include:
The alternative would be asymmetric cryptography. In this case you would have a private key and a public key. With this type of encryption, information encrypted with the private key can only be decrypted with the public key and vice-versa.
If this is the kind of security you're more interested in, then check out RSA (The industry standard) and Diffie–Hellman key exchange.