Comment by e12e | Hacker News Reader

Comment by e12e | Hacker News Reader

Parent Full thread

I'm not sure what you looked at, but the first example I found used a 32 byte key (256 bits = 8 * 32). From the readme :

> 5. Key generation functions will panic if they can't read enough random bytes to generate the key. Key generation is critical, and if crypto/rand fails at that stage then you should stop doing cryptography on that machine immediately.

Having less than a full encryption key is a fatal error! Not something to be padded around.

Apologies if there are some examples for key derivation from a password that somehow doesn't use only part of an array initialized to zero (which would be bad, adding random unitialized data to the kdf - good luck decrypting!).

But what if I want to encrypt "my secret" with "password1234"?. You can't require everybody to memorize exactly 32 bit passwords

Stop saying 32 bit, please. It's 32 byte, or 256 bit.

Furthermore, use a KDF to stretch your password into a key suitable for encryption.

Sorry, of course I mean 32 byte.

Passwords are not keys, but you can generate a key from a password with a Password-Based Key Derivation Function.

See https://en.wikipedia.org/wiki/PBKDF2

As natedub indicates, to turn a password into a key you need to use a password-based key-derivation function; PBKDF2 is standardised, sane and reasonably quick; scrypt and bcrypt get more love these days, but I think any of them would be sufficient.

A cryptographic key (unlike a password) needs to be exactly a certain length, and ideally be completely random (if not, at least indistinguishable from random): a password might be exactly that length, but it will _not_ be completely random (heck, if you can type it then certain bit patterns simply won't occur …).

The fact that '012345789ABCDEF012345789ABCDEF' and unhex('cd8fa5ecf22379c429f56fdaae511144f9b7704247a244859b943299eb57fb1d') have the same length in bytes is coincidental; they really are two very different types.

Reply on news.ycombinator.com