In this application, I'm actually generating strong passwords and assigning them to users — it's a unique case where that's not a usability concern, and the data is very rarely accessed. My thought with this setup is that I could assign, say, a 64-bit password, which I'd then use to generate longer keys for AES with a purposefully slow algorithm. I'd prefer not to assign users 128-bit AES keys directly because it will be harder for them to deal with the longer string.
In thinking about the code length, I'm trying to form an estimate with rough numbers like so: - I'd like to be able to generate the AES key in 10 microseconds (I lowered that based on your DDoS concern) - I'd like a brute-force attack to take 100 years - An adversary could devote 10,000 times my computing power to cracking (really not sure how to estimate this though... botnets, gpus...)
Given those numbers, my keys need log2(100 years * 10,000 / 10 microseconds) = 62 bits of entropy. So I'd assume 64-bit keys would be secure, if I generate them correctly.
Basically I'm trading off computation time on my server for giving users shorter keys.
I do want to rely on this. Most of the user data should be visible only to the user, although I'll keep some parts (account info) in plaintext or encrypted with a master key. I don't know of a way of avoiding the front-end risk other than making sure to secure it, because the key has to come from the user; only they have it.
Any thoughts on my estimate of the key length and the feasibility of this system?
I'm investigating whether I can use bcrypt not just for password hashing, but to encrypt database contents as well.The idea would be to run a strong password through bcrypt (with an appropriately high work factor, so that the operation takes perhaps 10ms), and then use the digest created as a symmetric key to encrypt the database record.I would obviously NOT store the digest in the database;...
I'm working on an authentication system that is a little different than a traditional username and password scheme.Each user is assigned a key, of length N bits. I'm giving the user a "password" with a full N bits of entropy, rather than letting them choose a (potentially weak) one. This is not a problem for this particular project.The goal of this post is to help determine N. I want N to be...