2

I'm writing a password manager, right now for each individual site, I already used master password + random salt with PBKDF2 to generate encryption key to encrypt its password (each site has its own salt).

Is it still secure to use master password + another random salt with PBKDF2 to generate hash for master password (this hash will be store in DB for user authentication)? Or should I use a hashing algorithm like SHA-256?

Improve this question
2
  • 1
    What's the point of not using the master password+slat directly for encrypting a given password ? I don't see how your system improves security.
    – Stephane
    Jul 7, 2015 at 8:05
  • @Stephane because master password+salt will be store in db to authenticate user, and I certainly don't want to store the encryption key in the clear.
    – gzup
    Jul 7, 2015 at 9:51

1 Answer 1

Reset to default
1

Since PBKDF2 could be use to generate as much bytes as you want/need, you can of course use it for both master password hashing and key generation. You don't even need to use different salt, just generate a n bytes hash, then generate n+m bytes, discard the first n bytes and use the other m bytes as key.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .