Encryption using a key derived from a password or passphrase entered by the user.

learn more… | top users | synonyms

0
votes
1answer
58 views

What is the proper way to generate a fixed length key from a variable length password?

The password is entered by the user and the key is processed locally. Neither the password nor the key will be stored, only used and forgotten (but hopefully not by the user). Is SHA256 by itself ...
0
votes
0answers
11 views

Keystore and configuration file

It appears that Java Keystore is often used by web server using a configuration file, with the password opening the JKS written in it and also the password protecting the specific entry. How could ...
1
vote
1answer
67 views

How does ccrypt work?

On many Linux/GNU distributions CCrypt (ccrypt) by Peter Selinger is available as a command line utility to encrypt files. How does the protocol work and is it ...
0
votes
0answers
33 views

Security comparison of the following PBE algorithms - PBKDF2WithHmacSHA1 Vs PBEWITHSHA256AND256BITAES-CBC-BC

Which among these conform to the PKCS#5 OR PKCS#12 standards ? Are they JCE compliant - In other words which providers have implemented them in a JCE compliant manner ? How do they fare in terms of ...
-1
votes
1answer
100 views

Bouncy Castle and Salsa 20

I want to use Salsa 20 in Java, so I downloaded Bouncy Castle, and... it makes no sense to me. I've got it working, but most of my choices were essentially random. But I can't see there anything ...
1
vote
1answer
80 views

Basic question about design of program with data encryption

I need to store encrypted files on a hard disk. The actual code side is not important for me now (I plan to use C# and AES-GCM encryption from Bouncy Castle library, please tell me if you think that's ...
1
vote
1answer
136 views

Which algorithm do you recommend for practical use to generate unique passwords for each website?

So, in my imagination there is this simple algorithm with only one master password, let's say a prime number 'p', which I have to remember. Using only the address of the website and p, the algorithm ...
1
vote
1answer
122 views

Rate my idea: is that a stronger GPG-like algorithm?

I came up with a simple idea but I don't know if it is really secure or not. I know that you shouldn't create any algorithm on your own. I'm just curious, that's all. Algorithm explanation: First ...
3
votes
2answers
209 views

Using PBKDF2 twice with different argument order

I'm pretty sure this is a really bad approach (in theory), but one of my clients is doing this and I was wondering… How bad it is to perform pbkdf-2 in this way (with 2000 iterations)? ...
4
votes
3answers
310 views

Can I create a fixed length output from a fixed length input?

I use AES256 for various purposes in my app. However, the purpose I am now trying to achieve is the following: Input is for example AU00000001 and I would like a ...
3
votes
1answer
273 views

Rfc2898DeriveBytes - password length

Trying to find related answer for a long time, but not convinced yet. What I am trying is to encrypt using RijndaelManaged. To create Key, I am passing password, ...
3
votes
2answers
468 views

Encryption Key derivation from numeric PIN?

I want to store data encrypted within an Android application. Keeping an encryption key safe outside the app is not an option so I looked into password derived key algorithms. I found a nice example ...
0
votes
1answer
144 views

How to store keys for a cascading encryption?

What is the best way to implement a cascade encryption? I'm trying to figure out how to cipher a string (or message) using Serpent-Twofish-AES and then store the keys. I'll provide an explanation, ...
2
votes
1answer
161 views

How to design a cryptographically secure file hosting service

How one would go about design something like Google Drive/Dropbox providing the following features: files are encrypted and decrypted on the client files can be synced between devices the service ...
4
votes
0answers
256 views

Is there a “brainwallet” for GPG keys? [closed]

“Brainwallet” is a program that takes a passphrase (hopefully a good one) and deterministically creates a Bitcoin wallet. This wallet can be used for transactions, then deleted from the computer. To ...
1
vote
1answer
313 views

Testing if a password for an eCryptfs mount is valid [closed]

I'm using "eCryptfs" on several directories on my dedicated Debian server. I mount them manually via mount -t ecryptfs [dir] [mountpoint] But after some weeks ...
3
votes
1answer
125 views

What security differences are there between E(p',“well-known-plaintext”) vs. hash(p') where p'=KDF(p)

I am using a KDF to derive a key, p' from a password p. I would like to know if the password is correct before using the derived ...
1
vote
2answers
371 views

How terribly flawed is this design for key storage?

Dave here, with a plan for storing secrets. Threat model: Database and keyfile may (will?) be stored on un-trusted servers. Database contains many valuable secrets (passwords), encrypted by key ...
2
votes
3answers
120 views

Securing content and login with “same” password

I'm writing a client application that wants to store some secret information with a storage service. The client has to authenticate the user with the service and the service should not be able to ...
-1
votes
3answers
439 views

how much is secure to encrypt a password using itself (as encryption key) for storing it on a unsecure media?

I want to store a password securely on a storage (suppose in a usual unencrypted file). I use this password as AES key to encrypt itself (using AES-ECB) & then store it on the media (the password ...
8
votes
2answers
440 views

How to derive two keys from one password

What is the best way to generate two independent symmetric keys from one user-entered password or passphrase? Would using both scrypt and pbkdf2 achieve this?
3
votes
3answers
579 views

How can mega store my login details and still be secure?

I understand how Mega's encryption works. For a quick summary of all those in the future looking for an answer on this... here is how it works: Upon first signing up for an account you make a ...
3
votes
1answer
118 views

Hashing a password with the password?

I was wondering if hashing a password with the password would be a good way of encrypting the password. So, the user must know his/her password to get the same result as the one in the database. Also, ...
5
votes
1answer
146 views

How to generate a key using any m passwords out of total n?

My application requires an AES-256 key K for some secure operation. In order to avoid saving this key in application, I have implemented following scheme: There ...
3
votes
1answer
502 views

Can I secure my key by XORing it with a hashed password?

I'd like to build a simple password-protected symmetric key system. The key-creation process in my system operates as follows: The system creates a 256-bit key purely at random. The user chooses a ...
3
votes
1answer
230 views

Is there a known vulnerability when using identical key and salt with PBKDF2?

For optimum security, a random salt should be chosen for PBKDF2. I came across a scenario where I produce a hash of a random file that serves as the "password". Due to the nature of files, this has ...
18
votes
4answers
14k views

Can you help me understand what a cryptographic “salt” is?

I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it. Can anyone offer me a ...
10
votes
1answer
960 views

How can I make my cipher show the avalanche effect?

I am a beginner in cryptography. I designed an password based encryption-decryption algorithm, which uses a random salt and a password to encrypt a message. I'm using SHA-512 for hashing, matrix ...