Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Consider adding KDF and salt to password encryption #1

Open
Gustav-Simonsson opened this issue Feb 13, 2015 · 0 comments
Open

Consider adding KDF and salt to password encryption #1

Gustav-Simonsson opened this issue Feb 13, 2015 · 0 comments

Comments

@Gustav-Simonsson
Copy link
Contributor

Currently the AES key is SHA256 of the user entered password. To make it harder for an attacker who gets hold of an encrypted key file, SHA256 can be replaced by a strong KDF which also uses a salt.

This would make it significantly harder to brute force decryption of weaker passwords.

Here is a example using scrypt and a cryptographically strong salt: https://github.com/ethereum/go-ethereum/blob/develop/crypto/key_store_passphrase.go#L117

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants
@Gustav-Simonsson and others