Problem - Kevin Tafuro

See Also
Recipe 13.2
4.2 Generating Random Symmetric Keys
Problem
You want to generate a secure symmetric key. You already have some mechanism for
securely transporting the key to anyone who needs it. You need the key to be as
strong as the cipher you’re using, and you want the key to be absolutely independent
of any other data in your system.
Solution
Use one of the recipes in Chapter 11 to collect a byte array of the necessary length
filled with entropy.
When you’re done using a key, you should delete it securely to prevent local attackers
from recovering it from memory. This is discussed in Recipe 13.2.
Discussion
In Recipe 11.2, we present APIs for getting random data, including key material. We
recommend using the spc_keygen( ) function from that API. See that recipe for considerations
on which function to use.
To actually implement spc_keygen( ), use one of the techniques from Chapter 11.
For example, you may want to use the randomness infrastructure that is built into
the operating system (see Recipes 11.3 and 11.4), or you may want to collect your
own entropy, particularly on an embedded platform where the operating system provides
no such services (see Recipes 11.19 through 11.23).
In many cases, you may want to derive short-term keys from a single “master” key.
See Recipe 4.11 for a discussion of how to do so.
Be conservative when choosing a symmetric key length. We recommend 128-bit
symmetric keys. (See Recipe 5.3.)
See Also
Recipes 4.11, 5.3, 11.2, 11.3, 11.4, 11.19, 11.20, 11.21, 11.22, 11.23, 13.2
Generating Random Symmetric Keys | 119
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.