Home/ Questions/Q 8563221
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-11T16:54:42+00:00

Inspired by my previous question , now I have a very interesting idea: Do

  • 0

Inspired by my previous question, now I have a very interesting idea: Do you really ever need to use Rfc2898DeriveBytes or similar classes to “securely derive” the encryption key and initialization vector from the passphrase string, or will just a simple hash of that string work equally well as a key/IV, when encrypting the data with symmetric algorithm (e.g. AES, DES, etc.)?

I see tons of AES encryption code snippets, where Rfc2898DeriveBytes class is used to derive the encryption key and initialization vector (IV) from the password string. It is assumed that one should use a random salt and a shitload of iterations to derive secure enough key/IV for the encryption. While deriving bytes from password string using this method is quite useful in some scenarios, I think that’s not applicable when encrypting data with symmetric algorithms! Here is why: using salt makes sense when there is a possibility to build precalculated rainbow tables, and when attacker gets his hands on hash he looks up the original password as a result. But… with symmetric data encryption, I think this is not required, as the hash of password string, or the encryption key, is never stored anywhere. So, if we just get the SHA1 hash of password, and use it as the encryption key/IV, isn’t that going to be equally secure?

What is the purpose of using Rfc2898DeriveBytes class to generate key/IV from password string (which is a very very performance-intensive operation), when we could just use a SHA1 (or any other) hash of that password? Hash would result in random bit distribution in a key (as opposed to using string bytes directly). And attacker would have to brute-force the whole range of key (e.g. if key length is 256bit he would have to try 2^256 combinations) anyway.

So either I’m wrong in a dangerous way, or all those samples of AES encryption (including many upvoted answers here at SO), etc. that use Rfc2898DeriveBytes method to generate encryption key and IV are just wrong.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    And attacker would have to brute-force the whole range of key (e.g. if
    key length is 256bit he would have to try 2^256 combinations)

    This is where you’ve gone wrong. If weak passwords have, say 8 characters, and there are roughly 5 bits per ASCII character, then there are around (2^5) ^ 8 weak passwords, which is about 2^40. Since you’re not using a salt, there are therefore only 2^40 possible keys. These keys are easy to generate by iterating through the possible combinations of 8 characters and hashing each of them. That is considerably easier to brute-force than 2^256.

    • 0