Passwords are secret keys which human beings can memorize.

learn more… | top users | synonyms (1)

-2
votes
0answers
33 views

hashing algorithm [closed]

I have a program which takes an input of username, the a password and then hashes it and gives integral output. It is not fixed for a particular character. I want to know its hashing algorithm. I ...
3
votes
2answers
71 views

Long passwords and Bcrypt

I need to store passwords for a web application, and was looking at Bcrypt for a possible solution. After some research, it appears only the first 72 bytes influence the final hash output. While it is ...
3
votes
1answer
32 views

Generating passwords from a master password using rules

I realize it's generally considered bad idea to use the same password everywhere. I can use icloud / lastpass to generate my passwords for me, but that leaves me clueless when I don't have access to ...
8
votes
4answers
521 views

Hashing a password before using for online accounts

I don't actually know what I'm talking about, so apologies if I get anything wrong. At the moment I have a password naming system for most of my online accounts that looks something like this: ...
4
votes
1answer
59 views

How to change the master password in a password manager

For a personal project, I'm building a password manager, based off the project in this syllabus from Stanford http://crypto.stanford.edu/~dabo/cs255/hw_and_proj/proj1.pdf Since I don't exactly have ...
1
vote
1answer
83 views

Cycling hashing in PBKDF's and their limitations in strength?

I hope this question isn't too similar to one that's already been asked. I also want to point out I know part the answer already, AFAIK: I just want some expert input on this. Let's model a hash that ...
2
votes
1answer
85 views

Encrypting passwords

I am using Android's keystore to generate a key which is protected by fingerprint authentication. This key can be used to encrypt any secrets. In my case, I want to encrypt a user password (which is ...
0
votes
2answers
94 views

Password in first line of file for AES-256 encryption

I'm using openssl with aes-256-cbc encryption to encrypt a file. The password is on the first line of the file and the ...
1
vote
1answer
56 views

Username and Password: How does it work?

Suppose a client (Alice) goes to an HTTPS website (Bob) over TLS 1.2. Alice sends Client Hello with some random number $r_a$. Bob sends Server Hello with another random number $r_b$. Suppose they ...
5
votes
1answer
63 views

Is my pin algorithm secure?

I'm a hobby programmer and very new to this field. I opened a bank account recently and got two pins. One for the girocard and the other for a creditcard. And I needed two more pins for the online ...
3
votes
1answer
73 views

How secure is Shamir's Secret Sharing for password sharing when attacker has t-1 shares?

I am designing protocol to share a random generated n long password between k parties using Shamir's Secret Sharing. I know that share alone does not reveal much information about the original ...
1
vote
1answer
164 views

Backdoorable hash function in password database

I want to use a (preferably established) hash function that is backdoorable in a password database. I want to do so because I need password escrow (being able to get the cleartext back. I want to ...
4
votes
2answers
131 views

Public key crypto instead of hashing passwords in a database

Suppose I want to keep a client's password database secure (not in plaintext), while still having access to the plaintext password. Now I generates a public/private keypair. Then I send the public ...
1
vote
0answers
50 views

How does hacking work exactly? [closed]

I've seen alot of posts on the web asking the same thing or "how to hack" but the answers all say that you need to know programming, this, that, etc. It's all very generic. Boiling it down to the ...
3
votes
1answer
127 views

Is it true that 7zip doesn't use any salt with its KDF?

This issue claims that 7zip does not use any salt with its key derivation function: https://github.com/magnumripper/JohnTheRipper/issues/1679 If that's true, wouldn't that mean you can crack multiple ...
1
vote
1answer
128 views

Cracking passwords with more than 10 characters in a few hours?

I came across this article from 2 years ago: http://www.dailymail.co.uk/sciencetech/article-2331984/Think-strong-password-Hackers-crack-16-character-passwords-hour.html They're describing how a team ...
3
votes
1answer
51 views

gpg --gen-random quality level: is higher “better”?

The GNU Privacy Guard manual pages have this to say about using the gpg --gen-random 0|1|2 count command: Emit count random bytes of the given quality level 0, ...
1
vote
1answer
58 views

Is it safe to generate ECDSA keys from the hash of the previous, over and over again?

I have memorized a very long and secure passphrase, that when hashed with sha256, I can use the result as an ECDSA private key, and use it as a brain-address for Bitcoin. Now I need more bitcoin ...
2
votes
1answer
60 views

Can the salting function complexity improve the hash robustness?

I'm quite novice in security, and all examples I saw seem to salt the password by concatenating it, or by applying a simple binary OR or XOR. So the hash is based on "salt + password", "salt | ...
1
vote
0answers
51 views

Properly storing an E-mail Password

I'm creating a messaging application that will use an outlook account to send an email. However, I'm unsure about the proper steps to store the e-mail password on the user's computer. Suppose I had ...
4
votes
1answer
94 views

Are shorter password hashes safe?

How much can I shorten a password hash before it begins to impact security? Suppose that I use PBKDF2 (correctly salted) with HMAC-SHA256 as the PRF. From what I've seen, it's typical to use 256 ...
3
votes
1answer
118 views

Is it possible to reverse the birthday attack calculation?

I find that for every 100 password salts in our database, we only average 94.73 distinct salt values (averaged over a total of around 18 million). Is there a way to take that observation and calculate ...
3
votes
1answer
46 views

Attacks on WinRAR volumes reusing same password?

I have quite a few WinRAR volumes that are all encrypted with the same password. The password is long and unbruteforceable, but I recently read that WinRAR uses PBDKF2 as its key-derivation function ...
2
votes
1answer
239 views

XTEA: patterns in plain text

I'm using XTEA to encrypt passwords that I store in a database. (I need to be able to decrypt these passwords later to log in on another system.) But now I have noticed something: if I decrypt a ...
0
votes
1answer
191 views

How long does it take to brute force a Wordpress password?

I'm not a cryptograhpy expert, I am a web developer trying to determine the origin of a Wordpress blog hack, and how likely it is that it was brute forced. The administrator account username had been ...
2
votes
1answer
183 views

Encryption algorithm used in WPA/WPA2

I want to know how EXACTLY the WPA password gets encrypted I have been searching through and I was able to catch: The actual password is converted to some hash Salting is applied to the hash The ...
1
vote
2answers
139 views

What are the required security properties for salts?

I was recently thinking about password hashing (maybe caused by the PHC progression). I started to think a little more about it and got stuck at this question: What security properties do ...
2
votes
2answers
97 views

Client login without sending a password

I would love to have a system where the password is never send in plaintext (even with TLS) to authenticate a user. I've come up with this protocol, but I'd rather use something proven. Registration: ...
3
votes
1answer
314 views

Recommended password complexity for SSH key encryption using AES-256-CBC

When protecting SSH private keys with password-based encryption, what would be a good minimum password complexity+length standard to make cracking the password too difficult to be worthwhile anytime ...
2
votes
1answer
77 views

How does the small n attack work?

I'm studying the Lamport's Hash one-time password scheme. This is the scheme: Alice wants to authenticate herself to Bob from a workstation that knows nothing about her. Alice only knows her ...
2
votes
1answer
96 views

Memory hard password based key derivation functions?

How are memory hard functions designed for the purpose of password based key derivation? To protect against a brute force attack from a parallel machine. What design could work well with Skein? The ...
2
votes
1answer
139 views

Extension of a password hashing algorithm using Fibonacci

I am right now taking a class named Applied Cryptography and our final project is to create a password hashing method using at least one existing algorithm and then add additional steps to make it ...
3
votes
1answer
59 views

Public SRP verifiers or public hash chain “public keys” when secret is low entropy password

I want to set up the following: An untrusted server should host user sessions and authenticate users without knowing their passwords or being capable of creating a fake user session in the user's ...
3
votes
1answer
121 views

How can I generate a good password from a SHA512 hash?

I have to change local administrator passwords on machines. I don't want to store password in a database. I have to generate a password that I can find later to connect to the machine again. So I ...
2
votes
1answer
53 views

Salting in asp.net?

I have spent the past hour reading up on salting and still don't understand how it is achieved. Forgive me if im wrong, but the way I am thinking of salting is, storing an ArrayList of random strings ...
0
votes
0answers
51 views

one complex password as a “seed” for localy generated per-service passwords

I've stumbled upon a project that suggests a way of having to remember one password, from which a “per-service password” could be generated by salting the service name using scrypt. What could be a ...
1
vote
1answer
47 views

About DH-EKE and ECDHE_PSK (PSK versus Pasword)

I am currently having a look at J-PAKE , so learning about Authenticated Key Exchange : Reading 2.2.2 E.K.E from this paper https://people.kth.se/~maguire/Erik_Ehrlund_Literature_Study_report_v1.2.pdf ...
5
votes
2answers
502 views

SHA-256 exhaustive search

How do I calculate the number of computations needed to break SHA256 in case we are using it for safely storing passwords (together with a salt)? Are there any formulas that can be employed? For ...
1
vote
2answers
91 views

How much pre-hashing a password increase security against brute force attack?

I am wondering how much hashing a password used as key for a symmetric key algorithm helps preventing brute force attack on crypted text. Let's assume I want to crypt text A using key B using ...
1
vote
2answers
84 views

Using password-based encryption as a hashing scheme

Classic scheme: Given password and hashing algorithm Generate salt Calculate ...
1
vote
3answers
96 views

Is this client-side password hash scheme secure?

I want to build an app that uses client-side encryption for storing encrypted data on the server. A user-specific master key would be used, so to easily share it between devices a encrypted version of ...
2
votes
5answers
3k views

“123456” and “password” as crack standards

I know that when we encrypt, we use standard encryption technologies and to store data it's often stored as a hash. By encrypting a common password, for example "password" using ...
1
vote
1answer
165 views

Extracting a WinRAR password

If I have an original file and a WinRAR password protected .rar file containing that file, than can I extract the password?
0
votes
2answers
51 views

Getting the encryption/has algorithm used for modem configuration file [closed]

Hello guys I have backed up my modem configuration file and found the username and password is in clear text; the files shows the username and the password is : ...
1
vote
3answers
223 views

How to quickly detect incorrect password in encrypted file without compromising security?

I am developing a software to encrypt/decrypt files/streams using symmetrical encryption algorithm. During encryption phase data wil be compressed and encrypted. When decrypting data, I want to be ...
1
vote
1answer
84 views

On countermeasures for replay attacks. Does this one require plaint text password storage?

I was reading this wiki section on the countermeasures against replay attacks and it basically suggests that: If Bob wants to confirm Alice's identity he can send a one-time token (I think it should ...
0
votes
1answer
94 views

What's wrong with an iterative (with counter) hashed salted KDF?

It seems like the brain-dead simplest KDF would have a key-stretching structure that is not substantially different from $\text{hash}(S | P | S | P |\dots|S|P)$, where $S$ is a salt and $P$ is a ...
1
vote
4answers
527 views

Why don’t all AES encryption tools produce the same key from the same password?

Alice and Bob meet regularly. They have agreed face-to-face a 128 bit password which they want use to encrypt/decrypt emails written between them. They decide to use 256-bit AES. Alice wrote her ...
4
votes
3answers
525 views

Practical Uses for Timing Attacks on Hash Comparisons (e.g. MD5)?

Consider the following code snippet: ...
0
votes
0answers
38 views

Registration and log in through public key cryptography?

I read about zero knowledge proofs. Let's say you want to create an account at a website. You choose a password $p$ and from $p$ you derive deterministically a public & private key pair $(e,d)$ ...