In "Sign and encrypt session data" (<https://ktor.io/docs/sessions.html#sign_encrypt_session>) the e...

# ktor

[martmists]

In "Sign and encrypt session data" (https://ktor.io/docs/sessions.html#sign_encrypt_session) the example code uses hex strings, can these be of any random hex sequence (assuming they're the same every time), or is there some importance to their values?

[ephemient]

fun SessionTransportTransformerEncrypt(encryptionKey: ByteArray, signKey: ByteArray, ivGenerator: (size: Int) - ByteArray = { size -> ByteArray(size).apply { SecureRandom().nextBytes(this) } }, encryptAlgorithm: String = "AES", signAlgorithm: String = "HmacSHA256")>

[ephemient]

for AES, the encryption key should be 128, 192, or 256 bits long
for a SHA-256 HMAC, the signing key size doesn't exactly matter since it'll be hashed, but I would expect 256 bits

[ephemient]

oh the class SessionTransportTransformerEncrypt documentation says the same, in terms of bytes though:

You have to provide keys of compatible sizes: 16, 24 and 32 for AES encryption. For HmacSHA256 it is recommended a key of 32 bytes.

[ephemient]

aside from the size requirements, any fixed random sequence can be a key