How to generate keys?

[philss]

This is a question and a proposal to add a little guide about key generation.

I tried myself, but I'm not sure if I'm doing right.

I followed this article about hash functions.
So, to generate the key I'm doing something like:

:crypto.hash(:sha256, "my-super-secret-key-here") |> Base.encode64
# => 2CJtBImYfIdlBKR0164Ys6xg+lAWaqaCVUrlK9OIKUE=

And them, I use this as my key:

config :cloak, Cloak.AES.CTR,
  tag: "AES",
  default: true,
  keys: [
    %{
      tag: <<1>>,
      key: :base64.decode("2CJtBImYfIdlBKR0164Ys6xg+lAWaqaCVUrlK9OIKUE="),
      default: true
    }
  ]

@danielberkompas Is there a better and more secure way (or tool) for generating those keys?
What do you think about adding a little guide in the README.md? I can get this if you agree.

BTW, thanks for this library! It's awesome! 😃

[danielberkompas]

If you want a random 256-bit key, all you have to do is generate 32 bytes and then run it through Base.encode64:

:crypto.strong_rand_bytes(32) |> Base.encode64

A random key is more secure than one based on a set of keywords. However, if you were going to use a keyword, your approach seems reasonable. Just be aware that if you use a keyword, it's just as subject to guessing as a password would be, and sha256 is generally considered insecure for passwords. Maybe use BCrypt instead?

When I do BCrypt in Elixir, I use the Comeonin library.

[philss]

Got it, thanks! :)
Random keys seems to be better.

[paulstatezny]

He @danielberkompas, I wasn't sure whether to comment here or open another issue...

Thanks for cloak! It's great.

I think it would be helpful to add details back to README.md or somewhere in plain sight on how to generate keys properly. Was working with a coworker and noticed that it was removed from the README.

If you're up for that I'd be glad to put in a PR.

[danielberkompas]

I'll add it into the docs soon. It's pretty simple:

:crypto.strong_rand_bytes(32)

If you intend to store your key in an environment variable, you'll need to Base64 encode/decode it as shown in the docs.

32
|> :crypto.strong_rand_bytes()
|> Base.encode64()

[acrolink]

If you intend to store your key in an environment variable, you'll need to Base64 encode/decode it as shown in the docs.

And if the key gets lost, all data encrypted with it will become useless (non-recoverable), true?