tozny/java-aes-crypto

Where should I store the salt?

nilsi opened this issue · 1 comments

nilsi commented

Hello, thanks for a great library!

Im encrypting some data using an autogenerated password stored (for each user) on a server.
When I want to decrypt the data I then recreate the key with salt generated from java-aes-crypto. I am currently storing the salt in the SharedPreferences on the cellphone but this seems wrong since a potential hacker could easily access it if the phone is rooted.

Where should I store the salt?

The salt is not secret, so you can store it next to the ciphertext. SharedPreferences is probably fine. The purpose of the salt is to make certain types of brute-force attacks difficult. The key / password is really the secret part.