download 256 bit password generator for aes

Passwords need to be hashed tens of thousands of times in order to delay one single try long enought to make a brute-force attack against the raw password infeasible. Just hashing the password to get a key does not do the trick because it does not slow down the brute force by a relevant amount. Brute-Force attacks against (possibly very weak) user passwords are far easier than against a full 128 (or 192, 256) bit key. I assume key is a password the user entered.ĭo not use that for encryption directly. So my question: Does combining a plain-text key with a random IV make for secure encryption? Or should I hash the key string with SHA-256 or something first, and use the result for the key? You'll notice that I get the key from the user, and pass it in plain text to SecretKeySpec. That variable comes from my getKey() method, which is as follows: public static String getKey() SecretKeySpec skeySpec = new SecretKeySpec( key.getBytes('UTF-8'), 'AES') Notice the key variable in the 6th line of code: So you can see, I am using the SecureRandom class to generate the random IV.

RawCryptotext = cipher.doFinal(textToEncrypt.getBytes()) SecretKeySpec skeySpec = new SecretKeySpec(key.getBytes('UTF-8'), 'AES') Ĭipher.init(Cipher.ENCRYPT_MODE, skeySpec, ivParams)

IvParameterSpec ivParams = new IvParameterSpec(iv) SecureRandom randomSecure = SecureRandom.getInstance('SHA1PRNG') īyte iv = new byte

TL DR - See bottomĬurrently, I'm encrypting like this: Cipher cipher = Cipher.getInstance('AES/CBC/PKCS5PADDING') I asked this question a while ago about IVs in AES, and I got a very nice and helpful answer (thanks!) so I was thinking maybe you guys could help me out again, this time with the actual key generation.

Download 256 bit password generator for aes