Enhancement of Key Derivation in DefaultValueEncryptor.java

[Anderson-Xia]

Is your feature request related to a problem? Please describe.

I've identified a potential security concern in the DefaultValueEncryptor.java within the DBeaver project. The current implementation bypasses a more secure key derivation process, directly using the password as the key. This approach could weaken encryption strength and may not comply with best practices suggested by NIST SP 800-63B.

   public static SecretKey makeSecretKeyFromPassword(String password) {
/*
        UUID projectID = getProjectID();
        ByteBuffer bb = ByteBuffer.wrap(new byte[8]);
        bb.putLong(projectID.getMostSignificantBits());
        byte[] salt = bb.array();
        PBEParameterSpec pbeParamSpec = new PBEParameterSpec(salt, 20);
*/

        //PBEKeySpec spec = new PBEKeySpec(password.toCharArray());
        byte[] bytes = password.getBytes(StandardCharsets.UTF_8);
        byte[] passBytes = Arrays.copyOf(bytes, 16);
        return new SecretKeySpec(passBytes, KEY_ALGORITHM);

/*
        try {
            return SecretKeyFactory.getInstance("AES").generateSecret(spec);
        } catch (Throwable e) {
            log.error("Error generating secret key for password", e);
            return null;
        }
*/
    }

Describe the solution you'd like
It is recommended to enhance key derivation process by using a PBE function.

Additional context
Here is the reference from NIST SP 800-63B.

Verifiers SHALL store memorized secrets in a form that is resistant to offline attacks.
Memorized secrets SHALL be salted and hashed using a suitable one-way key derivation
function. Key derivation functions take a password, a salt, and a cost factor as inputs then
generate a password hash. Their purpose is to make each password guessing trial by an attacker
who has obtained a password hash file expensive and therefore the cost of a guessing attack high
or prohibitive. Examples of suitable key derivation functions include Password-based Key
Derivation Function 2 (PBKDF2) [SP 800-132] and Balloon [BALLOON]. A memory-hard
function SHOULD be used because it increases the cost of an attack. The key derivation function
SHALL use an approved one-way function such as Keyed Hash Message Authentication Code
(HMAC) [FIPS 198-1], any approved hash function in SP 800-107, Secure Hash Algorithm 3
(SHA-3) [FIPS 202], CMAC [SP 800-38B] or Keccak Message Authentication Code (KMAC),
Customizable SHAKE (cSHAKE), or ParallelHash [SP 800-185]. The chosen output length of
the key derivation function SHOULD be the same as the length of the underlying one-way
function output.