Re: Password based key encryption format

[Andrew Sacamano]

Hi Evan,

My first though is yes, that sounds great. But it should be compatible with the C++ implementation, so please do try to make them inter-operable.

Thanks,

Andrew

On Fri, Apr 5, 2013 at 3:59 PM, Evan Jones <e...@evanjones.ca> wrote:

I am using Keyczar for a project, and I need to implement password-based key encryption. I see that the C++ version includes support for this, but the others do not. I'm attempting to implement this for Java, at least as an extension on top of the Java library. Quick questions:

1. Would there be any interest in accepting an external patch to allow the Java implementation to read/write password encrypted keysets?

2. If I implement this, should I follow the C++ implementation? Strangely, some of the defaults for password-based encryption aren't consistent with Keyczar's defaults:

* By default, it tries to use PBKDF2 with SHA256, but Keyczar typically uses HMAC-SHA1

* It doesn't HMAC the encrypted key, it just encrypts it with a generated AES128 key (as far as I can see)

I'm basically going to try to be compatible with the C++ implementation, but probably not worry about it too much. However, it would be great if this could be part of the standard Keyczar package!

Thanks,

Evan

--
You received this message because you are subscribed to the Google Groups "Keyczar Discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to keyczar-discu...@googlegroups.com.
To post to this group, send email to keyczar...@googlegroups.com.
Visit this group at http://groups.google.com/group/keyczar-discuss?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[James Tuley]

The C# version and Go versions also have a compatible version of PBE key sets. At least reading compatible with the c++ test data which uses PBKDF2 with HMAC-SHA1. But depending on the version of OpenSSL the c++ version was compiled with it will switch to PBKDF2 with HMAC-SHA256 like you say.

I agree that the PBE implementation leaves something to be desired.

http://code.google.com/p/keyczar/issues/detail?id=118

As does the tool support

http://code.google.com/p/keyczar/issues/detail?id=117

-Jay

Sent from my iPad