Java SealedObject

I am encrypting an string with PBEWITHSHA256AND128BITAES-开发者_运维百科CBC-BC using SealedObject and write it to a file. After encrypting when i do a cat on the resulting file i i get read the salt used and the algorithm used in plain text even though the actual data is encrypted.

Doesn't that give crackers a head start? They know the salt and the algorithm with basically zero effort.

---

The salt isn't secret. Its purpose is generally to prevent dictionary attacks.

Keeping the algorithm secret is security through obscurity, which is pretty much universally discouraged.

---

When you use PBE (Password-Based Encryption), salt and iteration are just to make cracking more expensive. You only need to generate key once but guessers will have to try millions.

If you require salt to be secret, it defeats the purpose of the password. Password is something easy to remember but less secure. If you really worried about security, don't use password. Use a secret key.

Hiding salt is practically a double key scheme. In most cases, it doesn't make your cipher much stronger.