0

If I want to be able to create a private key given inputs x,y,z and these inputs are constant, if I add enough entropy as a salt would it be secure to create a key this way (in terms of brute force attacks or reverse engineering) and be able to re constitute it given the same inputs where the salt also never changes, pseudo code where x,y,z are

val salt = "4D6250655368566D597133743677397A"
val output = SHA256(salt + x + y + z)

and recursively hash the output 100,000x sort of like using 3 passwords

1

It will be as secure as trying to decrypt passwords with a constant salt. You can use whatever source of entropy you want, but if your salt gets published you'll have problems, specially for those users whose x, y and z are easily guessable via dictionary attack.

That being said, I'm not saying it's a bad solution, I just pretended to remark that it's definitely possible, but there are more secure options. It depends on you particular needs.

A stronger solution would be to generate a random salt for each user, being this salt stored on a different database than your users' data, and if possible in a different machine.

| improve this answer | |
  • Yeah I understand the security risks, the salt would never be committed to source code, x y z are UUID's so they are not human readable words. Per your last comment on salt per user, the idea is to have a sort of stateless / databaseless storage system. No database to compromise, only source code, hence a deterministic approach. – Brian Oct 28 '19 at 17:17
  • Well, if x, y and z are UUIDs I think you are fine. – Molina Oct 28 '19 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.