Home/ Questions/Q 666693
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T23:50:47+00:00

I’m doing password based file encryption in Java; I’m using AES as the underlying

  • 0

I’m doing password based file encryption in Java; I’m using AES as the underlying encryption algorithm and PBKDF2WithHmacSHA1 to derive a key from a salt and password combination using the following code (which I got from another generous poster on this site).

SecretKeyFactory f = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
KeySpec ks = new PBEKeySpec(password,salt,1024,128);
SecretKey s = f.generateSecret(ks);
Key k = new SecretKeySpec(s.getEncoded(),"AES");

I share the salt, the user enters their password at each end and encryption and decryption work fine 🙂 My problem is that i would like to be able to verify that the password the user enters is correct before embarking on the (potentially long) decryption process. I know the PBKD spec includes an optional 2 byte verification value but I’m not sure how to generate this value using the above approach. Does Java provide support for this or if not what would be a secure alternative?

Thanks for your time.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Hey, thanks to crazy scot and Chris for there help. After doing some digging i decided to use the methods described on Dr Gladmans file encryption page for doing both password verification and message authentication. I believe this method, based on the PBKDF2 and a MAC, makes deriving the verfication value for m the password sufficiently expensive as to make it secure. Thanks again, and i hope this solution aids others.

    • 0