Best way to store an AES Key

Question

Hello,
I'm currently developing a little "file vault" , with graphical interface, to enable end users to encrypt/decrypt some of their personal files on teh filesystem
I'm currently using AES as Cipher :
the first time the user launches the UI, i generate an key for AES then store it (encoded as Base64) in Registry (if Windows) using java.util.Preferences
Doing this, later, the application automatically retrieves this key for decrypt/encrypt tasks.
Is this the best way to store this kind of key.
I currently ask myself if i couldn't (as second option) leave the user choose a key first : the user should then retype this key at every launch of the application to be able to decrypt/encrypt his files.
What is the best way?
Laurent

Answer 1

As far as i understand in the document PKCS#5 , to do my application, i should use the PBES2 (password based encryption scheme 2), respecting the following steps :
Encryption:
1) Select a Password (P) : this password is not stored on the system, the user will provide it to the application for every operation (dec / enc)
2) Select a Salt (S) : i wonder if first time i should use a pseudo random generator, then store the Salt on the System (where on Windows or Linux?...)
3) Select an iteration Count (c) : should be > 1000
4) select a derived key Length (dkLen)
5) Create a derived key (DK) using the formula : DK = DKF(P,S,c,dkLen)
6) Encrypt clear Message M using the Derived Key (DK) an the algorithm AES, to obtain the Cipher Text (C)
Decryption:
Repeat steps 1 to 5
6) Decrypt Cipher Text (C) using DK and AES algorithm to obtain the clear message (M)
Does it sound good for you.
My question is always the same :
Should i hard code in my application the Salt ,the Iteration Count, and the derived key length or , should i first generate a pseudo random Salt, then store it on the file system (Windows Registry, File)
Any idea?
Laurent
Message was edited by:
Laurent_Bois