You want to generate a secure symmetric key. You already have some mechanism for securely transporting the key to anyone who needs it. You need the key to be as strong as the cipher you’re using, and you want the key to be absolutely independent of any other data in your system.
Use one of the recipes in Chapter 11 to collect a byte array of the necessary length filled with entropy.
When you’re done using a key, you should delete it securely to prevent local attackers from recovering it from memory. This is discussed in Recipe 13.2.
In Recipe 11.2, we present APIs for getting random data, including
key material. We recommend using the spc_keygen(
)
function from that API. See that recipe for considerations on which
function to use.
To actually implement spc_keygen( ), use one of
the techniques from Chapter 11. For example, you
may want to use the randomness infrastructure that is built into the
operating system (see Recipe 11.3 and Recipe 11.4), or you may want to
collect your own entropy, particularly on an embedded platform where
the operating system provides no such services (see Recipe 11.19
through Recipe 11.23).
In many cases, you may want to derive short-term keys from a single “master” key. See Recipe 4.11 for a discussion of how to do so.
Be conservative when choosing a symmetric key length. We recommend 128-bit symmetric keys. (See Recipe 5.3.)
Get Secure Programming Cookbook for C and C++ now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
