I built a system that allowed users to generate an unlimited number of email add

Question

I built a system that allowed users to generate an unlimited number of email addresses.

Instead of storing each one in a db, I created addresses dynamically and made the address an hmac signed message with the shared secret being the bcrypt hashed version of their account password. e.g. 1948417:11eea538fdc926e38ff97689d913d34da152b072@example.com

Security wasn't critical and it worked pretty well, but I'm considering using the same strategy for something a little more delicate.

So, the question is... Is using a hashed password as the shared secret a good idea or bad idea?

Explanation / Answer

The most common password hashing functions are actually designed for exactly this purpose -- deriving a cryptographic key from a (weak) password. That's actually what PBKDF2 stands for: "password-based key derivation function #2" (scrypt and bcrypt don't have it in their name, but are also key derivation functions). It's also used in GPG, and for file and disk encryption, etc. Kerberos does so as a login mechanism - when you send the KDC your username, you get information that lets you authenticate as that user, encrypted with a key derived from the user's password.

Passwords tend to be low-entropy, far below that required of a cryptographic key. PBKDFs mitigate that by having a salt (to prevent dictionary attacks, for instance by having a list of the keys derived from the 10000 most common passwords) and by being as time-consuming as you please, which means that while an attacker doesn't have to try as many possibilities as with a random key, it takes them a long time to try each possible password.

So in general, password-derived keys make fine shared secrets. There are some catches (notably: if an attacker compromises them, they've compromised the shared secret; this is why Kerberos KDCs have to be so secure). But there's nothing generally wrong with the concept

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.