As much as you're being downvoted and attacked, you'veyour idea is absolutely right, correct, and valid.
You've nearly reinvented bcrypt.
Let's say we have encryption algorithm (doesn't matter which one):
I'll choose blowfish.
Then generate random sequence of chars consisting predefined array (for instance just random sequence of digits)
AI'll pick a sequence of 24 characters;characters. And even better if it's an even multiple of the blowfish 8-byte blocksize of blowfish:
OrpheanBeholderScryDoubt
\______/\______/\______/
| | |
8-bytes 8-bytes 8-bytes
Encrypt sequence with our algorithm with given password and store it somewhere in safe place (let's call it as saved value)
The password needs to be transformed into a 72-byte encryption key - the key size of blowfish. Bcrypt does this with a function called ExpensiveKeySetup:
String password = "correct horse battery staple";
Int32 costFactor = 12;
Byte [16]Byte[16] salt = CryptGenRandom(16);
Byte[72] key = ExpensiveKeySetup(password, salt, costFactor);
And in fact, bcrypt encrypts thethen we'll encrypt our random sequence 64of chars. And just to be extra secure: we'll encrypt it 64 times:
Byte[24] ciphertext = BytesOf("OrpheanBeholderScryDoubt");
for int i = 1 to 64 do
ciphertext = BlowfishEncrypt(cipherText, ref key);
(Why use 3-DES when you can use 64-DES!)
And now you have your stuff to store:
- costFactor
- salt
- ciphertext
Bcrypt coverts the salt and ciphertext to base64, and gives you a string:
$2b$[costFactor]$[salt][ciphertext]
Such as:
$2a$12$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa
Now time to check password validity
Try to decrypt saved value with probe password
Rather than decrypt, just repeat the encryption of the same fixed starting value"OrpheanBeholderScryDoubt", with the password, and the same salt. And compare the result to what you stored.
It would be nice if the community was nice, helpful, or knowledgeable - rather than just attacking or using clichesclichés.