I'm developing an app that requires multiple passwords to access varying data areas. For example, a group of people could set up a chat that requires password authentication to view.
Here's how I'm considering doing it:
I have my keyword, let's say hypothetically:
Banana
When the user enters their password, I use RNCryptor to encrypt Banana using their entered key, and store that encrypted string to the server.
Later, when someone tries to enter a password, I take the hashed value from the server and try to decrypt it using the password they entered as a key. If the decrypted value equals Banana I know they entered the correct password.
I'm new to security, so I'm not sure if this would be an appropriate solution. All help is appreciated.
Update
After making some alterations suggested by @Greg and the aptly named @Anti-weakpasswords, here's what I have:
- (NSDictionary *) getPasswordDictionaryForPassword:(NSString *)password {
NSData * salt = [self generateSalt256];
NSData * key = [RNCryptor keyForPassword:password salt:salt settings:mySettings];
NSMutableDictionary * passwordDictionary = [NSMutableDictionary new];
NSString * saltString = stringFromData(salt);
NSString * keyString = stringFromData(key);
passwordDictionary[@"key"] = keyString;
passwordDictionary[@"salt"] = saltString;
passwordDictionary[@"version"] = @"1.0.0";
passwordDictionary[@"iterationCount"] = @"10000";
return passwordDictionary;
}
static const RNCryptorKeyDerivationSettings mySettings = {
.keySize = kCCKeySizeAES256,
.saltSize = 32,
.PBKDFAlgorithm = kCCPBKDF2,
.PRF = kCCPRFHmacAlgSHA1,
.rounds = 10000
};
- (NSData *)generateSalt256 {
unsigned char salt[32];
for (int i=0; i<32; i++) {
salt[i] = (unsigned char)arc4random();
}
NSData * dataSalt = [NSData dataWithBytes:salt length:sizeof(salt)];
return dataSalt;
}
