Hello, > Ok I have taken comment so far and this is my plan - if I am way off > please let me know > > create a public salt (anyone can see this and will) of X length (128bits) > take sha512 hash of file to be encryted (and keep it) > supply a password to the pbkdf2 - to create a 256bit key for my AES256 > CFB encryption > use the hash with same salt in pbkdf2 and create a 128 bit iv > > Encrypt the file and leave it anywhere in public for me to get later > (even in an untrusted place). > > Would this work and where are the weaknesses in the plan? Yes, this will work but "standard" method for this is to: - choice a password (secret) - choice a iteration count (secret, in OpenSSL default is 1 but suggested value is > 1000) - choice a salt (public) - put all that to pbkdf2 and get from this function 32+16 bytes - use first 32 as AES256 key, use next 16 bytes as IV In this situation salt must be distributed with encrypted file (in OpenSSL salt is added as special formated first line in encrypted file).
Best regards, -- Marek Marcola <[EMAIL PROTECTED]> ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
