Passwords are secret keys which human beings can memorize.

learn more… | top users | synonyms (1)

3
votes
1answer
125 views

Is it possible to reverse the birthday attack calculation?

I find that for every 100 password salts in our database, we only average 94.73 distinct salt values (averaged over a total of around 18 million). Is there a way to take that observation and calculate ...
3
votes
1answer
50 views

Attacks on WinRAR volumes reusing same password?

I have quite a few WinRAR volumes that are all encrypted with the same password. The password is long and unbruteforceable, but I recently read that WinRAR uses PBDKF2 as its key-derivation function ...
2
votes
1answer
275 views

XTEA: patterns in plain text

I'm using XTEA to encrypt passwords that I store in a database. (I need to be able to decrypt these passwords later to log in on another system.) But now I have noticed something: if I decrypt a ...
1
vote
1answer
105 views

Value of S and r in Fiat-Shamir Protocol

In the book Cryptography and Network Security by Forouzan,in chapter 14, Fiat-Shamir protocol, its mentioned that two large prime numbers p and q are chosen and kept secret. However n=p*q is made ...
0
votes
1answer
341 views

How long does it take to brute force a Wordpress password?

I'm not a cryptograhpy expert, I am a web developer trying to determine the origin of a Wordpress blog hack, and how likely it is that it was brute forced. The administrator account username had been ...
2
votes
1answer
362 views

Encryption algorithm used in WPA/WPA2

I want to know how EXACTLY the WPA password gets encrypted I have been searching through and I was able to catch: The actual password is converted to some hash Salting is applied to the hash The ...
1
vote
2answers
163 views

What are the required security properties for salts?

I was recently thinking about password hashing (maybe caused by the PHC progression). I started to think a little more about it and got stuck at this question: What security properties do ...
2
votes
2answers
108 views

Client login without sending a password

I would love to have a system where the password is never send in plaintext (even with TLS) to authenticate a user. I've come up with this protocol, but I'd rather use something proven. Registration: ...
3
votes
1answer
461 views

Recommended password complexity for SSH key encryption using AES-256-CBC

When protecting SSH private keys with password-based encryption, what would be a good minimum password complexity+length standard to make cracking the password too difficult to be worthwhile anytime ...
28
votes
6answers
5k views

Is there a secure cryptosystem that can be performed mentally?

I, myself, do not plan on getting into a situation where I would be unable to use a computer in order to communicate securely. However, I can think of many practical situations in which mental ...
2
votes
1answer
153 views

Extension of a password hashing algorithm using Fibonacci

I am right now taking a class named Applied Cryptography and our final project is to create a password hashing method using at least one existing algorithm and then add additional steps to make it ...
3
votes
1answer
123 views

How can I generate a good password from a SHA512 hash?

I have to change local administrator passwords on machines. I don't want to store password in a database. I have to generate a password that I can find later to connect to the machine again. So I ...
5
votes
2answers
532 views

SHA-256 exhaustive search

How do I calculate the number of computations needed to break SHA256 in case we are using it for safely storing passwords (together with a salt)? Are there any formulas that can be employed? For ...
2
votes
1answer
62 views

Salting in asp.net?

I have spent the past hour reading up on salting and still don't understand how it is achieved. Forgive me if im wrong, but the way I am thinking of salting is, storing an ArrayList of random strings ...
0
votes
0answers
52 views

one complex password as a “seed” for localy generated per-service passwords

I've stumbled upon a project that suggests a way of having to remember one password, from which a “per-service password” could be generated by salting the service name using scrypt. What could be a ...
1
vote
1answer
62 views

About DH-EKE and ECDHE_PSK (PSK versus Pasword)

I am currently having a look at J-PAKE , so learning about Authenticated Key Exchange : Reading 2.2.2 E.K.E from this paper https://people.kth.se/~maguire/Erik_Ehrlund_Literature_Study_report_v1.2.pdf ...
1
vote
2answers
108 views

How much pre-hashing a password increase security against brute force attack?

I am wondering how much hashing a password used as key for a symmetric key algorithm helps preventing brute force attack on crypted text. Let's assume I want to crypt text A using key B using ...
1
vote
2answers
90 views
6
votes
3answers
402 views

Can passwords be stored securely so that a similarity comparison can be made?

On the Pro Webmasters StackExchange site, someone asked a question about a webapp (in this case cPanel) that refused to allow a password change because it was too similar to a previous password. I ...
2
votes
5answers
3k views

“123456” and “password” as crack standards

I know that when we encrypt, we use standard encryption technologies and to store data it's often stored as a hash. By encrypting a common password, for example "password" using ...
2
votes
1answer
202 views

Extracting a WinRAR password

If I have an original file and a WinRAR password protected .rar file containing that file, than can I extract the password?
0
votes
1answer
574 views

How many attempts does it take to crack a 32-bit password hash with this scenario?

How many attempts does it take to crack (match) a 32-bit password hash from a database of 4 million password hashes? Correct me if I'm wrong, but to crack a 32-bit password hash would take roughly ...
0
votes
2answers
60 views

Getting the encryption/has algorithm used for modem configuration file [closed]

Hello guys I have backed up my modem configuration file and found the username and password is in clear text; the files shows the username and the password is : ...
1
vote
3answers
259 views

How to quickly detect incorrect password in encrypted file without compromising security?

I am developing a software to encrypt/decrypt files/streams using symmetrical encryption algorithm. During encryption phase data wil be compressed and encrypted. When decrypting data, I want to be ...
1
vote
1answer
97 views

On countermeasures for replay attacks. Does this one require plaint text password storage?

I was reading this wiki section on the countermeasures against replay attacks and it basically suggests that: If Bob wants to confirm Alice's identity he can send a one-time token (I think it should ...
0
votes
1answer
103 views

What's wrong with an iterative (with counter) hashed salted KDF?

It seems like the brain-dead simplest KDF would have a key-stretching structure that is not substantially different from $\text{hash}(S | P | S | P |\dots|S|P)$, where $S$ is a salt and $P$ is a ...
0
votes
4answers
670 views

Why don’t all AES encryption tools produce the same key from the same password?

Alice and Bob meet regularly. They have agreed face-to-face a 128 bit password which they want use to encrypt/decrypt emails written between them. They decide to use 256-bit AES. Alice wrote her ...
0
votes
0answers
38 views

Registration and log in through public key cryptography?

I read about zero knowledge proofs. Let's say you want to create an account at a website. You choose a password $p$ and from $p$ you derive deterministically a public & private key pair $(e,d)$ ...
3
votes
4answers
432 views

Password length versus hash length?

If a system hashes passwords with a 256-bit long hash, are passwords (which are not necessarily alphanumeric, can be any value per byte (0-255)) longer than 32 bytes useless under the context in which ...
0
votes
1answer
67 views

How do I control an access code safely?

Upon registration an user has to specify an access code of five digits. This access code is also used as a password for the encryption and decryption of certain strings. The user types in "12345" ...
1
vote
1answer
50 views

Errata for NIST SP 800-63

I'm looking through the latest version of NIST SP 800-63, and there is a table (Table A.1) in the Appendix that supposed give the "entropy" of a password for a 94 character alphabet for various ...
2
votes
2answers
336 views

Generate secure password hashes without access to PBKDF2 or bcrypt

Given is a system, which does provide only implementations of fast hash algorithms (MD5, SHA1, SHA-256, SHA-512). There is no implementation of PBKDF2, bcrypt or scrypt available. The system does ...
9
votes
1answer
5k views

How do I store encrypted files on a web server and decrypt them locally?

I want to store files (images) on a public webserver and let users see them if they know a password. The server shouldn't have the unecrypted files and the server can only serve files, not perform ...
0
votes
1answer
118 views

What is the proper way to generate a fixed length key from a variable length password?

The password is entered by the user and the key is processed locally. Neither the password nor the key will be stored, only used and forgotten (but hopefully not by the user). Is SHA256 by itself ...
1
vote
1answer
335 views

Creating a random password based off of a prime number

So I am making an application that basically creates strings that must be encrypted before they are stored on a user's device. If the user blindly starts running the application without creating a ...
0
votes
2answers
147 views

Removing “security by obscurity” from port knocking

Every article about port knocking, for instance https://wiki.archlinux.org/index.php/Port_Knocking , declares this method as security by obscurity. Is the following enough to remove that title; a ...
1
vote
2answers
167 views

Idea for secure password hash-likes, is this feasible/usable/workable?

(Hand moved from stackoverflow.com,due to suggestion) Since breaking password hashes has become a new passtime for scriptkiddies, I thought of the problem and came up with a novel(?) idea. store ...
0
votes
1answer
66 views

Are passwords generated from sine vulnerable to certain attacks?

A friend mentioned that he used the sine of a number, i.e. sind(54), to generate long passwords. This way he only has to remember sine 54 and have a calculator to get his password back. I am wondering ...
1
vote
2answers
51 views

Automatic generation of secure passwords with the least inconvenience for a user

I'm working on a web site for a private company that should allow them to upload files, which will be later retrieved by their affiliates. The site will be available from a public Internet using ...
1
vote
0answers
30 views

Any ideas on login using Digital Signature PKCS

I am curious to know about possibility to login into web application just by identifying the user based on digital signature in usb token. any reference in this direction?
53
votes
3answers
24k views

How should I calculate the entropy of a password?

If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
0
votes
3answers
379 views

Implementing a web app where the server cannot decrypt its own data?

I'm a cryptography novice, but I think that the world needs to move towards an "encrypt everything" mentality as much as possible. As a result, I've been thinking a lot about ways to build a web app ...
-1
votes
2answers
201 views

Is there a client-side program to cryptography a HTML page and decode if correct password is writen? [closed]

I want to know if there is an easy way to do this: create a complete HTML page cryptography the text content (image is not important) ask user some password check the password with a cryptographed ...
0
votes
1answer
89 views

Adding a Password Hash (key derivation) function to existing password storage solution

As always we are trying to improve password storage; before just adding new ways of storing our password we need to define what threats we will mitigate by adding in a new way to store our password. ...
8
votes
1answer
680 views

What are the security implications of multiple hashing?

There are plenty of questions on this site about hashing passwords. However, none of them quite cover this topic. One of those links covers using multiple different hash algorithms; one covers general ...
1
vote
1answer
68 views

Protecting a short password

I figured that a really secure password would be an AES 128 key. If this key were to be base 64 encoded, I could replace 4 random bytes in it in order to make it unusable unless you know which bytes ...
4
votes
2answers
2k views

Can a salt for a password hash be public?

For my understanding salts in password hashes are used to prevent the precomputation of $plaintext \to hashvalues$ (rainbow tables). I know from different threads, it is not necessary to keep the ...
0
votes
0answers
53 views

Password generation/storage scheme

How bad is the following strategy for a password manager on a local machine? The user wants to sign up for somesite.com where he needs a password. The user has previously generated a secret key ...
0
votes
2answers
210 views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...