# Tagged Questions

Passwords are secret keys which human beings can memorize.

2answers
7k views

### What makes a hash function good for password hashing?

Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the ...
6answers
5k views

### Is there a secure cryptosystem that can be performed mentally?

I, myself, do not plan on getting into a situation where I would be unable to use a computer in order to communicate securely. However, I can think of many practical situations in which mental ...
5answers
33k views

### Can you help me understand what a cryptographic “salt” is?

I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it. Can anyone offer me a ...
3answers
26k views

### How should I calculate the entropy of a password?

If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
3answers
2k views

### Is using slow password hashing on the client side easier attackable than on the server side?

As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
2answers
3k views

### Is there a way to make RC4 (ARCFOUR) secure, or is it completely broken?

I need a method to authenticate a process with another in order to establish interprocess communication between them, to prevent malicious processes from trying to hook onto the system. Currently I ...
6answers
1k views

The definition of PBKDF2 states that I obtain a derived key (1) by calling a pseudorandom function a bunch of times recursively: $U_1 = PRF(password, salt)$ $U_2 = PRF(password, U_1)$ … $U_n ... 4answers 1k views ### Webapp password storage: Salting a hash vs multiple hashes? For security's sake, of course it's blasphemous to store passwords in plain-text; using a hash function and then doing a re-hash and comparison is considered much better. But, if bad guys steal your ... 3answers 2k views ### Is this password migration strategy secure? I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ... 2answers 936 views ### Is bcrypt better than GnupPG's iterated+salted hashing method? GnuPG has slow hash built-in in form of iterated+salted S2K. Does it have disadvantages in comparance with bcrypt or scrypt? Is GnuPG's slow hash method easily automated in GPUs? 5answers 2k views ### How can rainbow tables be used for a dictionary attack? I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length. The maximum length I can enforce is 14 characters. ... 3answers 434 views ### What differentiates a password hash from a cryptographic hash besides speed? I understand that password hashes like bcrypt have the principal property of taking a long time to run, but I'm wondering what if anything about password hashes make them superior to merely running a ... 2answers 2k views ### Use of salt to hash a password In a few implementations of hashed passwords, I have seen that the length of the random salt is chosen to be, say, 10 or "some constant". Is there any specific reason why the salt is chosen to have a ... 3answers 2k views ### Change Salt when Changing Password? Assume a password storage scheme using a computationally-expensive hash algorithm and a CSPRNG salt. User ID, salt, and hash value are stored in a table; if the table is compromised, all three ... 2answers 709 views ### Do I have to have a different salt for each password? Should I use a different salt for each password? In my system, there are no user names, only passwords. When a user logins in, he types in one or more passwords and the server compares the results ... 1answer 367 views ### Does salt size affect password hash security? I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of ... 1answer 823 views ### Recommended way of adding a pepper/secret key to password before hashing? There have been several questions regarding password hashing here and on Security.SE. A "pepper" is sometimes mentioned – an application-specific secret key. The canonical answer on password hashing ... 1answer 637 views ### Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6? I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ... 1answer 1k views ### What happens to the entropy of a password when you hash it? For example, if the entropy of a password is 30 bits, what is the entropy of the password when you hash it with MD5? 1answer 267 views ### Why are there$ signs in my passwd file?

I am trying to get access to my eReader and I managed to get the passwd file. ...
2answers
642 views

### How did LinkedIn “salt” all their passwords?

First, just to make sure I understand "salting" correctly: You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
2answers
1k views

### Deriving HMAC key and cipher key from passphrase? [duplicate]

I'm encrypting a file with AES-256 in CBC mode. I needed to add an HMAC for authentication and validation of the file contents and passphrase, so I used a SHA-256 HMAC over chunks of my file ...
2answers
1k views

### Hash decrypts key, key decrypts cipher… why?

I noticed recently that a couple of pieces of encryption software (TrueCrypt being one of them) don't directly use a hash of the password as the key for the block cipher. Instead, they generate a ...
1answer
219 views

### How to generate a key using any $m$ passwords out of total $n$?

My application requires an AES-256 key K for some secure operation. In order to avoid saving this key in application, I have implemented following scheme: There ...
3answers
912 views

### Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
3answers
3k views

### Do I have to recompute all hashes if I change the work factor in bcrypt?

The well-known article about why we should use bcrypt for hashing passwords mentions the work factor - some parameter to the algorithm that determines how long one hashing should be in terms of number ...
2answers
223 views

### Public key crypto instead of hashing passwords in a database

Suppose I want to keep a client's password database secure (not in plaintext), while still having access to the plaintext password. Now I generates a public/private keypair. Then I send the public ...
1answer
404 views

### How can one share information using the 'host-proof' paradigm?

I am attempting to make a web-based secure password management and sharing utility, both as an academic exercise and to fully understand and feel safe about using it. I really like the idea of a "...
2answers
2k views

### Can a salt for a password hash be public?

For my understanding salts in password hashes are used to prevent the precomputation of $plaintext \to hashvalues$ (rainbow tables). I know from different threads, it is not necessary to keep the ...
2answers
325 views

### If Bob steals Alice's private key, how exactly would he read her encrypted documents?

So Bob grabs Alice's secret key when she isn't looking and her encrypted files, doesn't he need to know her passphrase to read her files? What I am reading is that no he does not need it but as far ...
1answer
448 views

### What's the reason for applying the hash twice when hashing with salt?

One of the typical approaches to computing a salted hash is this: hash(salt+hash(secret)) where hash is something like SHA-256 hash function - taking any size ...
1answer
228 views

### Securely generating passwords based on a secret and a public identifier

I'm trying to create a good scheme for generating passwords in my systems management scripts. What I'd like to do is have a secret key (let's say hello123), which I ...
2answers
241 views

### Using PBKDF2 twice with different argument order

I'm pretty sure this is a really bad approach (in theory), but one of my clients is doing this and I was wondering… How bad it is to perform pbkdf-2 in this way (with 2000 iterations)? ...
1answer
96 views

### gpg --gen-random quality level: is higher “better”?

The GNU Privacy Guard manual pages have this to say about using the gpg --gen-random 0|1|2 count command: Emit count random bytes of the given quality level 0, ...
2answers
382 views

### Generate secure password hashes without access to PBKDF2 or bcrypt

Given is a system, which does provide only implementations of fast hash algorithms (MD5, SHA1, SHA-256, SHA-512). There is no implementation of PBKDF2, bcrypt or scrypt available. The system does ...
2answers
316 views

### Could completely public passphrase hashes ever be reliably secure?

This is a hypothetical question and I only have a basic understanding of Cryptography. If one were to follow the very best cryptographic practices for storing passphrases, could it ever be possible ...
2answers
3k views

### How exactly would someone crack a private key passphrase? [closed]

Lets say for a PGP/GPG pair with a passphrase.
2answers
179 views

### What are the required security properties for salts?

I was recently thinking about password hashing (maybe caused by the PHC progression). I started to think a little more about it and got stuck at this question: What security properties do password-...
1answer
165 views

### Does it make sense to stretch non-keys?

I was thinking about stretching salt. Key-stretching is good against brute force guessing and assumes your system isn't compromised. Salting a one-way makes it so you have to compute * n for each ...