Passwords are secret keys which human beings can memorize.
2
votes
1answer
110 views
Recommended way of adding a pepper/secret key to password before hashing?
There have been several questions regarding password hashing here and on Security.SE.
A "pepper" is sometimes mentioned – an application-specific secret key. The canonical answer on password hashing ...
2
votes
2answers
118 views
Commutativity of keyed hashes
Definition
${H_1}^{K_1}(X)$ means data $X$ hashed by keyed hashing algorithm $H_1$ with key $K_1$.
Short question
Is $H_1^{K_1}(H_2^{K_2}(X))$ equal to $H_2^{K_2}(H_1^{K_1}(X))$?
Is ...
2
votes
1answer
151 views
estimate of time required to crack sha512crypt password with JtR + OpenCL
OK, I have a shadow file with a password that I know, it is 4 letters followed by two numbers. Using John The Ripper with OpenCL support, on a laptop with AMD Radeon Mobility graphics, how long would ...
2
votes
1answer
143 views
Ideal passphrase length: old diceware method (5 words) vs. your Bitcoin wallet.dat passphrase lenght (8 words) and doubling passwords?
I made a cool 5 word passphrase back then using the old Diceware method and use it as a master password. The question is as computing power increases will we need to add more and more words to our ...
2
votes
1answer
109 views
Seed a PRNG with random data and a password
I'd like to combine a random key file with a password to generate a secure seed for a CSPRNG. The key file is assumed to have very high entropy, but the password will be whatever the user provides. ...
2
votes
1answer
93 views
Why are there $ signs in my passwd file?
I am trying to get access to my eReader and I managed to get the passwd file.
...
2
votes
2answers
146 views
Assymetric password encryption - Viable? Which algorithm?
We have an application that requires cleartext passwords for user authentication because of the authentication mechanism in use (RADIUS/CHAP), which unfortunately we cannot change. Since we don't want ...
2
votes
0answers
97 views
Single-purpose symmetric encryption scheme for single files
I'm writing a simple password manager program that will encrypt/decrypt a single file (it's size will most likely stay under a few K). This is my initial file format design:
...
2
votes
0answers
69 views
Why does the SRP6 calculation of B included a multiplier k = 3?
In SRP6 $B$ is calculated as $B=kv+ g^b, k=3$. What is the purpose of $k$, and why was it fixed as $3$?
(In SRP 6b, this value $3$ is replaced by $k = H(N,g)$, but this question is about SRP 6.)
2
votes
0answers
46 views
Encrypting or HMACing password digests
Assuming I'm using bcrypt to digest passwords, is any additional security gained by either encrypting or HMACing the resulting digests? By requiring a key to compare password hashes, I would expect ...
2
votes
0answers
110 views
john the ripper, usages [closed]
As evident from the site of john the ripper, JTR example, john can be used for finding password form a unix machine passwd file.
can JtR be used to crack password ...
1
vote
2answers
81 views
What can a master password also be called?
When having a company computer that is full disk encrypted, it is common that the boss have a master password / backdoor, so the data always can be decrypted.
I have heard some call this for "scrow" ...
1
vote
3answers
348 views
Is public-key cryptography the only option in this scenario?
Two parties: a client and a server are to a agree on a symmetric key. Both the client and the server are aware of a master password. The way this is currently done ...
1
vote
2answers
95 views
It is reasonably safe to leave a SSH private key with a 30+ character passphrase public?
I'm curious about exploring uses for a distributing a single RSA private key with a passphrase instead of trying to secure the private key and distribute the public key. With the private key (and ...
1
vote
1answer
97 views
How can encryption software accept password lengths which are not one of the AES key lengths?
AES comes with key sizes of 128, 192, and 256 bit.
But in Truecrypt or other crypto software we can use passwords of different length, even less than 128 bit or more than 256 bit.
How is this ...
1
vote
2answers
273 views
Passwords with same SALT. What does this mean?
If the same SALT is used for many passwords on a Linux server, in what way is that a security risk?
Does the mean, that a user (which can change his own password) can calculate other users passwords?
...
1
vote
2answers
107 views
Where can I learn basic cryptography to know more about passwords and Bitcoin?
Basically my knowledge in passwords consist of setting up a Diceware master password back then, and I know hashes are not convertible back to the original password.
Some basic question I want to know ...
1
vote
2answers
123 views
Idea for secure password hash-likes, is this feasible/usable/workable?
(Hand moved from stackoverflow.com,due to suggestion)
Since breaking password hashes has become a new passtime for scriptkiddies, I thought of the problem and came up with a novel(?) idea.
store ...
1
vote
1answer
230 views
Can I secure my key by XORing it with a hashed password?
I'd like to build a simple password-protected symmetric key system. The key-creation process in my system operates as follows:
The system creates a 256-bit key purely at random.
The user chooses a ...
1
vote
1answer
100 views
Password verification
I'm looking for feedback on whether or not this is the proper way to approach password verification without transmitting the actual password. Are there any problems with this scheme.
We are working ...
1
vote
1answer
190 views
What happens to the entropy of a password when you hash it?
For example, if the entropy of a password is 30 bits, what is the entropy of the password when you hash it with MD5?
1
vote
1answer
118 views
synchronization of counters in HOTP
How is synchronization of counter values achieved in the HOTP protocol?
As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
1
vote
1answer
302 views
How to generate one-time password
Through my reading about the generation of one-time password (OTP) I found that there are many algorithms that generate OTP and they are either based on time such as TOTP or based on mathematical ...
1
vote
1answer
117 views
How is the password sent across for verification?
I am familiar with Challenge-Response Authentication scheme.
However I would like to know actual message content sent between client and server for 1 way authentication, over an insecure channel.
...
1
vote
3answers
785 views
Dictionary attack on pass-phrases on common algorithms
I don't yet perfectly understand the difference between brute-force and dictionary attack since this differentiates one attacking the key and another attacking password: apparently attacking passwords ...
1
vote
1answer
739 views
Is AES restricted to only 64 characters for the key/password?
I am wondering if AES only supports 64 character passwords?
When using truecrypt, the maximum character limit on passwords is 64 characters; however, when using WinRAR, the limit is 128 characters.
...
1
vote
0answers
133 views
Academic papers on GPU password cracking? [closed]
Are there any scientific papers or publications on GPU password cracking?
1
vote
2answers
150 views
Deriving HMAC key and cipher key from passphrase? [duplicate]
I'm encrypting a file with AES-256 in CBC mode. I needed to add an HMAC for authentication and validation of the file contents and passphrase, so I used a SHA-256 HMAC over chunks of my file ...
0
votes
2answers
155 views
Idea for user/pass hashing to prevent rainbow tables, would it work?
I'm very new to cryptography (and security in general, for that matter), but I had an idea that I'm sure is very flawed, but is worth asking. If a computer user, online account, etc, needs to verify a ...
0
votes
2answers
129 views
Is stretching hash several times basically the same as bcrypt?
As I understand it, the main advantage of bcrypt is stretching so it becomes slower to crack overtime. But, is using a "good enough" algorithm (e.g., SHA-2 family) then stretching until it's slow ...
0
votes
1answer
778 views
Store user passwords in database using Java Application
I want to store user's password details in Database. My project is in Java. I want to know the best way of storing passwords and other inportant information like user
0
votes
2answers
75 views
Using salted hash as password for easy memorization without reuse?
I had an idea earlier:
Secure passwords are a) long, and b) unpredictable. A hash is both of these. Would it be safe to reuse a key between sites, and include the site's name as a salt? For example:
...
0
votes
1answer
92 views
Sensible usecase for restricting special characters in passwords? [closed]
Please See Why Not Allow Special Characters In a Password on Security.
Several websites I've come across limit the allowed special characters for a password. My thought was, it should all be ...
0
votes
1answer
143 views
password entropy calculation
I have the following password with a prescribed format: it starts with a fixed value of 111, followed by 2 random lower case letters and then lastly a random digit:
"111""2 Random lowercase ...
0
votes
2answers
113 views
What is the advantage of an attacker over breaking a 4 digits PIN?
When a hardware system is protected by a 4 digits password, what is the advantage of the attacker into breaking that system?
Isn't it $10*10*10*10=10^{4}$? If $\frac{1}{10^{4}}$ is the cost of such ...
0
votes
1answer
69 views
How to take SHA-1 safely for my particular case?
Let me ask about my toy passwords generator program X5 which I want to improve.
X5 uses a secret key and a public key to generate a password.Where any public key is supposed to be known to hackers in ...
0
votes
2answers
133 views
How can I store a combination of multiple pass phrases?
Let's assume we have 2 phrases, one is the real password from a user, and the other is generated from the real password and almost impossible to guess. You would need both to authenticate a user. What ...
0
votes
1answer
391 views
iSeries (AS/400) Database File: password encryption
I am helping with a project in which an old software system on an iSeries is having a brand new .NET UI applied to it. It's going well... except...
In order to allow users to login and maintain ...
0
votes
0answers
117 views
Password crackers in CUDA [closed]
Is there any good password crackers in CUDA. Is the version available free of John the ripper can be deployed in CUDA?
-1
votes
1answer
92 views
Pseudo-random Number generation for Passwords
i want to know what is the best pseudo-random number generation algorithm for passwords? for example my scenario is I have to generate 5K pseudo-random bits from a user-supplied password(6 ...
