Passwords are secret keys which human beings can memorize.
3
votes
1answer
178 views
How can one share information using the 'host-proof' paradigm?
I am attempting to make a web-based secure password management and sharing utility, both as an academic exercise and to fully understand and feel safe about using it.
I really like the idea of a ...
0
votes
2answers
155 views
Idea for user/pass hashing to prevent rainbow tables, would it work?
I'm very new to cryptography (and security in general, for that matter), but I had an idea that I'm sure is very flawed, but is worth asking. If a computer user, online account, etc, needs to verify a ...
0
votes
2answers
113 views
What is the advantage of an attacker over breaking a 4 digits PIN?
When a hardware system is protected by a 4 digits password, what is the advantage of the attacker into breaking that system?
Isn't it $10*10*10*10=10^{4}$? If $\frac{1}{10^{4}}$ is the cost of such ...
13
votes
1answer
386 views
Is this password migration strategy secure?
I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
2
votes
1answer
93 views
Why are there $ signs in my passwd file?
I am trying to get access to my eReader and I managed to get the passwd file.
...
2
votes
3answers
424 views
Hash function in PBKDF2
From this excellent answer I learned (correct me if I am wrong) that when writing a block cipher with say key size 128 bit, one has to pad the password given (variable size) so that it becomes exactly ...
3
votes
2answers
400 views
How did LinkedIn “salt” all their passwords?
First, just to make sure I understand "salting" correctly:
You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
3
votes
1answer
224 views
What's the reason for applying the hash twice when hashing with salt?
One of the typical approaches to computing a salted hash is this:
hash(salt+hash(secret))
where hash is something like SHA-256 hash function - taking any size ...
1
vote
2answers
123 views
Idea for secure password hash-likes, is this feasible/usable/workable?
(Hand moved from stackoverflow.com,due to suggestion)
Since breaking password hashes has become a new passtime for scriptkiddies, I thought of the problem and came up with a novel(?) idea.
store ...
6
votes
2answers
375 views
Hash decrypts key, key decrypts cipher… why?
I noticed recently that a couple of pieces of encryption software (TrueCrypt being one of them) don't directly use a hash of the password as the key for the block cipher. Instead, they generate a ...
1
vote
0answers
133 views
Academic papers on GPU password cracking? [closed]
Are there any scientific papers or publications on GPU password cracking?
1
vote
1answer
118 views
synchronization of counters in HOTP
How is synchronization of counter values achieved in the HOTP protocol?
As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
1
vote
1answer
734 views
Is AES restricted to only 64 characters for the key/password?
I am wondering if AES only supports 64 character passwords?
When using truecrypt, the maximum character limit on passwords is 64 characters; however, when using WinRAR, the limit is 128 characters.
...
2
votes
1answer
71 views
Rapidly changing passwords?
Suppose you need to authenticate yourself to a program with the password - but the program's source code is public, the program doesn't have access to any private information and all your ...
2
votes
0answers
110 views
john the ripper, usages [closed]
As evident from the site of john the ripper, JTR example, john can be used for finding password form a unix machine passwd file.
can JtR be used to crack password ...
4
votes
1answer
363 views
How is BCrypt secure when it uses a static dataset for blowfish hashing?
I'm planning on using this Javascript BCrypt implementation, but as you can see in the code, it uses a 4KB precalculated dataset for the P and ...
3
votes
3answers
848 views
Simple/beginner level explanation of salt
I'm a beginner to cryptography and looking to understand in very simple terms what salt is, when I might need to use it and why I should/should not use it. Can anyone offer me a very simple and clear ...
0
votes
1answer
69 views
How to take SHA-1 safely for my particular case?
Let me ask about my toy passwords generator program X5 which I want to improve.
X5 uses a secret key and a public key to generate a password.Where any public key is supposed to be known to hackers in ...
14
votes
3answers
5k views
How should I calculate the entropy of a password?
If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
1
vote
1answer
302 views
How to generate one-time password
Through my reading about the generation of one-time password (OTP) I found that there are many algorithms that generate OTP and they are either based on time such as TOTP or based on mathematical ...
0
votes
2answers
133 views
How can I store a combination of multiple pass phrases?
Let's assume we have 2 phrases, one is the real password from a user, and the other is generated from the real password and almost impossible to guess. You would need both to authenticate a user. What ...
1
vote
1answer
230 views
Can I secure my key by XORing it with a hashed password?
I'd like to build a simple password-protected symmetric key system. The key-creation process in my system operates as follows:
The system creates a 256-bit key purely at random.
The user chooses a ...
1
vote
2answers
273 views
Passwords with same SALT. What does this mean?
If the same SALT is used for many passwords on a Linux server, in what way is that a security risk?
Does the mean, that a user (which can change his own password) can calculate other users passwords?
...
5
votes
5answers
236 views
In storing passwords in a database should I use a per-application salt in addition to a per-secret salt?
Assuming that the salts are sufficiently long (16 random chars) is there any advantage in using a per-application salt in addition to a per-secret salt when storing hashed passwords in a database?
...
1
vote
1answer
117 views
How is the password sent across for verification?
I am familiar with Challenge-Response Authentication scheme.
However I would like to know actual message content sent between client and server for 1 way authentication, over an insecure channel.
...
3
votes
2answers
119 views
How is de-synchronisation of HOTP solved?
From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong ...
7
votes
7answers
662 views
How can I improve a password generation scheme based on a shared secret and URL?
I currently use the following method to generate a different password on every website I have to login:
password = SHA1 ( mainPassword . domainName . number )
...
2
votes
2answers
1k views
How exactly would someone crack a private key passphrase?
Lets say for a PGP/GPG pair with a passphrase.
3
votes
2answers
230 views
If Bob steals Alice's private key, how exactly would he read her encrypted documents?
So Bob grabs Alice's secret key when she isn't looking and her encrypted files, doesn't he need to know her passphrase to read her files?
What I am reading is that no he does not need it but as far ...
6
votes
1answer
631 views
How does HOTP keep in sync?
My understanding of HOTP is that each password is unique and based on a counter.
$$PASSWORD = HOTP_1(K,C)$$
Where $C$ is an incremental counter.
What I wish to know, is how you keep the client ...
2
votes
4answers
619 views
Webapp password storage: Salting a hash vs multiple hashes?
For security's sake, of course it's blasphemous to store passwords in plain-text; using a hash function and then doing a re-hash and comparison is considered much better.
But, if bad guys steal your ...
3
votes
1answer
142 views
Is a changing public truecrypt container secure?
I have a Truecrypt container which I want to synchronise between computers (i.e. different people, that I want to share the data with).
If I used Dropbox for synchronisation and someone downloaded ...
5
votes
3answers
1k views
SHA1 usage for passwords, alternatives and advantages?
My application can authenticate via openid and oauth (facebook, twitter, etc) and also with its own authentication system. I previously switched hashing from MD5 to SHA1 and during migration I had to ...
10
votes
5answers
632 views
Why does PBKDF2 xor the iterations of the hash function together?
The definition of PBKDF2 states that I obtain a derived key* by calling a pseudorandom function a bunch of times recursively:
...
1
vote
3answers
784 views
Dictionary attack on pass-phrases on common algorithms
I don't yet perfectly understand the difference between brute-force and dictionary attack since this differentiates one attacking the key and another attacking password: apparently attacking passwords ...
1
vote
3answers
348 views
Is public-key cryptography the only option in this scenario?
Two parties: a client and a server are to a agree on a symmetric key. Both the client and the server are aware of a master password. The way this is currently done ...
2
votes
2answers
245 views
Are there public slow-but-strong algorithms out there that resist brute-force attacks better?
I'm reading that AES uses 4x4 bytes (4*4*8 = 256 bits key) matrix for performances matters (since it's a requirement for common standard encryption algorithms), but are there implementations with ...
7
votes
2answers
548 views
How should I store passwords that need to be available in plain text?
Suppose I need to store login information for a third-party website for a few users, how would I go about doing it?
Since I am logging into a third party website, I need the password in plain-text, ...
0
votes
1answer
390 views
iSeries (AS/400) Database File: password encryption
I am helping with a project in which an old software system on an iSeries is having a brand new .NET UI applied to it. It's going well... except...
In order to allow users to login and maintain ...
15
votes
3answers
672 views
Is using slow password hashing on the client side easier attackable than on the server side?
As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
