Challenge 34 ☆☆

Welcome to challenge Challenge 34.

Generating Random Keys

Many security folks teach engineers to use secure key derivation functions like PBKDF2 when a key needs to be generated. A developer followed this instruction and tried to create a key in Challenge34.java, which should now be far more secure than a hardcoded key. Can you spot the mistake? Can you find the value of the generated key?

💡 Tip: Secrets are often strings, numbers, or encoded values. Copy and paste exactly what you find.

This challenge can be solved by replaying the Key derivation function with the given inputs.

  1. Run the function online

    • Locate the parameters used for the key derivation function in the generateKey function in Challenge34.java.

    • Copy the used parameters to an online generator and execute it

    • The website will return the value of the key.

Why Key Derivation Functions are not safe when using hardcoded values

Key Derivation Functions (KDFs) are deterministic. This means that they will always give back the same output for a given input. So, if the parameters are hardcoded, anyone with access to the code can run the KDF with the specified parameters and get the key.

Use a KDF such as Argon2id with a unique random salt and appropriate cost parameters when deriving a key from a password. For machine-generated keys, use a cryptographically secure random number generator instead of a KDF, and store the key separately from the encrypted data.


⬅️ Previous
🏠 Main Page
Next ➡️
0