kolohe/FirstCryptoDot — Issue #1: Passphrase should be hashed before being used as an encryption key
Author: tomrittervg
Created: 2011-12-23 03:28:11+00:00
State: open

Here the passphrase is used directly as the AESKey:

```
String _testString = stringToHex(textKey);
byte[] salt = hexToByteArray(_testString + _testString + _testString);

AESKey aesKey = new AESKey(salt, 0, 256);
```

The passphrase should be sent through a [KDF](http://en.wikipedia.org/wiki/Key_derivation_function) before being used as a key. Ideally the KDF is slow: this makes brute force attempts harder.

ASCII text is completely non-random. For example, the top bit is always 0. Plus, there's only 96 printable characters. Plus English text follows common patterns, like 'e' being the most common letter. A KDF is used to eliminate these patterns.