Questions tagged [passwords]

Passwords are secret keys which human beings can memorize.

Filter by
Sorted by
Tagged with
3 votes
1 answer
112 views

Judgment of Results from NIST Randomness Testing

I am using the NIST suite to test the randomness of binary numbers and I have a 64KB dataset. I am confused with the results in finalAnalysisReport.txt. I have the ...
yuting zhang's user avatar
0 votes
1 answer
132 views

Is there a quantum-safe password-based authentication method that doesn't require giving the server too much data

I've been reading up on different authentication protocols recently while I implemented the sign-in functionality for my website. Many of the suggested methods password-based authentication seem to ...
n-l-i's user avatar
  • 445
2 votes
1 answer
141 views

Password Manager Architecture and Design

I'm working on a local, client-side password manager. I want to hash a master password with argon2 to store it safely in an SQLite database. This will be how a user could login and be authenticated. (...
dvub's user avatar
  • 123
2 votes
2 answers
689 views

How secure is the password from the hash sum (SHA-512) of a long sentence

If I convert a long sentence (>50 characters) to c and use the result (128 hex characters) as a password, how secure is it?
NewLinux's user avatar
  • 121
0 votes
0 answers
65 views

Can you have a public password file that is still secure?

So I’ve been reading about different ways to store passwords on servers (plain text, encrypted, hashed, hashed + salt, slow hash + salt) and I wanted to find a way where a leak of the stored passwords ...
Beacon of Wierd's user avatar
0 votes
0 answers
43 views

Transmit a password to inheritors

I am looking for a safe and easy way for my inheritors to get a password after my death. That can be the password of a digital vault, a password manager, or anything else. I could write the password ...
mifrey's user avatar
  • 1
3 votes
3 answers
142 views

Generating Complex Passwords from (Non-)Memorable Phrases - Need Advice

I've been thinking about creating strong and unique passwords for my online accounts, but I also want them to be memorable. I've come across the idea of using a memorable passphrase as the basis for a ...
user7113370's user avatar
1 vote
1 answer
124 views

The state of Shamir's Secret Sharing in 2023

Shamir's Secret Sharing GPL implementation called ssss got removed from Tails OS years back. Is Shamir's secret sharing still secure nowadays? Why was it removed ...
Sir Muffington's user avatar
1 vote
1 answer
113 views

Why don't basically all "clusters" and similar distributed systems use Shamir's secret sharing method?

When I came to the topic of Ansible (Vault), when deploying secrets in Ansible and other passwords up to 128 characters Shamir's Secret Sharing would be an ideal solution I think: The secret is never ...
Sir Muffington's user avatar
2 votes
1 answer
66 views

Can limited password/PIN length be compensated by a computationally intensive hashing function?

Say we have a very limited password space with only a 4 digit PIN, so only 10000 PIN possibilities. Say also that the attacker has access to the stored form of the PIN. Can breaking the PIN be made ...
hunger's user avatar
  • 123
0 votes
1 answer
110 views

who creates the passkey (and how many will be created)? [closed]

Passkey is nice. The math is nice. The tech is nice. https://security.googleblog.com/2023/05/so-long-passwords-thanks-for-all-phish.html What I still dont see after sooo many hours: what software ...
r j's user avatar
  • 101
0 votes
1 answer
211 views

How many bits should change in a password salt?

In https://crypto.stackexchange.com/a/27828/79037, it's indicated that one can "save space" by using something globally-unique, like an application-wide "pepper", together with ...
ManRow's user avatar
  • 343
0 votes
0 answers
34 views

Academic papers for the pros and cons of password based system and digital signature with challenge and response system

I don't really know what should be the correct title for this and the community can correct it after reading. I was the author of PKDSA (Searchable on github). I have the idea to do it because I feel ...
Hern's user avatar
  • 159
6 votes
1 answer
286 views

Cache-hard or memory-hard password hashing algorithms?

bscrypt is a cache-hard password hashing algorithm/KDF from Steve Thomas (aka Sc00bz/TobTu), who was on the Password Hashing Competition (PHC) panel. He argues it is better than the alternative ...
samuel-lucas6's user avatar
2 votes
1 answer
268 views

Best practices on implementing a password manager

I'm a dev new to security and cryptography. I'm writing a password manager and Time-based OTP combo in dart/flutter to use in multiple devices and platform for fun and use it personally for real. I ...
anthonychwong's user avatar
2 votes
1 answer
49 views

Is hashing salt possible even with the password with salt appended to the end?

Should you hash the salt on its own ? Is that possible? for example being password with salt appended at the end hash(pass || salt) and hash(salt) in a password file?
Bus's user avatar
  • 21
3 votes
1 answer
160 views

Is it possible to sign in to a website using two different passwords using an MD5 hash collision?

I wanna do an experiment. I wanna see if it's possible to sign in to an outdated website that still uses MD5 to store passwords (there are surprisingly still a lot) with two different passwords. For ...
Domino's user avatar
  • 31
3 votes
1 answer
93 views

Can using an unknown, non uniform random salt increase difficulty for password attacks?

I remember reading a previous stack exchange post (unfortunately was unable to find the link, if someone knows the link that would be great!) about a method to make password checking time for the ...
Manu Bhat's user avatar
0 votes
2 answers
307 views

Is sha3 a one-way funtion

If i store sensitive stuff (e.g passwords, salted passwords, Internet protacel adresss(so i know its not tamperd with), private keys(the keys are using a portion of the key on multiple disks in ...
Downvoter's user avatar
0 votes
1 answer
69 views

Use name as the initialization vector to encrypt passwords for users

I'm using AES-256-CBC to encrypt password for a set of users, and for each user in the database we gotta generate and store the password in the database. The ...
troubleddev's user avatar
3 votes
2 answers
297 views

How to calculate probability of cracking a password from entropy?

I am working on a project for my maths assessment where I research the effect of complexity and length on a given password. Currently, I am working on calculating the probability of guessing a ...
Ember's user avatar
  • 33
1 vote
2 answers
102 views

Remembering user credentials by double-hashing

I'm developing a desktop application where the users will login with username and password, which is then verified against a database. After the initial login, the current user should be automatically ...
Anlo's user avatar
  • 113
0 votes
1 answer
51 views

Higher encryption, means less strong password required?

Does higher encryption mean that my password could be shorter? If the time to decrypt is longer, then the chance to bruteforce gets lower too, right? I've created a KeePass database, and at the ...
Tree Lover's user avatar
2 votes
2 answers
360 views

Designing a scheme to store encrypted data on a backend

My goal is to design an encryption scheme for the application so that the backend stores encrypted data and the whole process of encoding and decoding happens on the frontend. And you can be sure that ...
WardS's user avatar
  • 123
2 votes
3 answers
3k views

Number of characters in 64-bit and 128-bit password

I have a simple question but I can't seem to find the answer of. I know that A 128-bit hash contains 32 characters since each represents a hexadecimal. Similarly, a 64-bit hash would contain 16 ...
netbeansnewbie's user avatar
5 votes
4 answers
574 views

Sending password to server vs. sending SHA

This is an existing website with approx. 100K accounts, and passwords are hashed using bcrypt with a high number of rounds. The current design that I'm questioning is that we're sending the username ...
Per's user avatar
  • 185
9 votes
2 answers
3k views

How strong are Bitlocker recovery keys?

This is an example of a bitlocker recovery key; 820042-335825-646573-481530-265253-688132-339900-822810 İs that key actually strong? It does not have any letters, ...
asd's user avatar
  • 91
0 votes
1 answer
3k views

Is 7-Zip Encryption really secure? [duplicate]

Is 7-Zip really a good encryption tool? I wonder what kind of encryption is used in 7-zip. I see most people using 7-Zip. Just curious about what extent it is safe.
Bhargav - Retarded Skills's user avatar
3 votes
1 answer
1k views

Why does SHA-256 have any to do with scrypt?

I was reading the Wikipedia page for scrypt because I wanted to learn more about it and I came across their pseudocode for the algorithm. What confused me was the following line: I don't understand ...
Darcy Sutton's user avatar
2 votes
1 answer
305 views

Benefit of salt in KDF like Argon2

I don't understand why I need a salt for Argon2 if Argon2 is only needed as a KDF for a password which is then called AES. At the end neither the password nor a password hash is stored. Only the data ...
user105538's user avatar
3 votes
2 answers
998 views

Password Hashing based on Common Passwords

If an attacker has a database of 1,000 users' hashed passwords which are hashed with SHA-256 with a 128-bit salt and all of these users used 10,000 common passwords. How many hashes will the hacker ...
CryptoGuru's user avatar
0 votes
1 answer
79 views

Password space: number of possible password combination

How do I calculate the password space of a randomized linked hybrid pasword of 9 images and 10 numbers(0-9)? User allowed to select 4 password Images=9 Pin= 0-9 Password selection allowed: 4 Every ...
Gloria Jiya's user avatar
1 vote
2 answers
243 views

Hashes to passwords with PBKDF2

If an attacker wants to hack the passwords of $2^{10}$ users. And all of these users generate a password from the space of $2^{50}$ passwords** and each password is hashed with PBKDF2 with $2^{10}$ ...
CryptoGuru's user avatar
4 votes
2 answers
1k views

Password hashing and salting with SHA-256 on $2^{64}$ password space

If a password is randomly chosen from a space of $2^{64}$ passwords and is stored as an SHA-256-bit hash and a 128-bit salt, how many hashes does an attacker need to perform to recover the password in ...
CryptoGuru's user avatar
1 vote
0 answers
88 views

How many hashes to recover a salted password? [closed]

If a password p is selected from a space of 2^64 passwords, and the server stores this as a hash, h = SHA-256(p||s) where s is a random 128-bit salt. How many maximum hashes would an attacker need to ...
CryptoGuru's user avatar
3 votes
0 answers
676 views

Algorithm used to generate a BitLocker recovery key

I know exactly how a generated BitLocker recovery key works and I can write a code to brute-force it. How is the recovery key generated though? I could think of some answers: it is generated using an ...
abbas's user avatar
  • 165
1 vote
1 answer
397 views

KEY using AES-128, If P is less than 128 bits, padded with 0 and create 128 bits, any problem if average pw length is 6

For communication between the client and the website, use password (P) as the key using AES-128. If P is less than 128 bits, it is padded with 0 to create a 128 bits key. is there any problem with ...
lmmd1234's user avatar
0 votes
2 answers
698 views

Password encryption in database

I want to store passwords in a database in a way I can reuse them to authenticate users (symmetrical encryption). I read some good information here: https://cheatsheetseries.owasp.org/cheatsheets/...
Merinorus's user avatar
1 vote
2 answers
197 views

Debug bcrypt iterations with a static salt [closed]

I want to debug bcrypt rounds with a static salt using this python lib ...
pacman's user avatar
  • 429
1 vote
3 answers
796 views

Base64 or hex to attach auth tokens to URL?

I just came across this question, but it does not really answer my main concern that I have regarding password tokens. To authenticate a client who is not logged in; I generate two random tokens and ...
DevelJoe's user avatar
  • 113
0 votes
1 answer
51 views

How easy is it to identifiy the key when knowing a certain number of different AES-256/Fixed Nonce encrypted long-integers

Given some intervals of long integers (64 Bits). I need to generate alphanumeric strings which: should be used like passwords(known only by few individuals) must always be the same for the same ...
aschoerk's user avatar
  • 111
1 vote
1 answer
176 views

best encryption algorithm for encrypting a string

I am making a password manager , I am new to cryptography, so , can someone tell me if this can be a good solution? 1- the user inputs the email/password 2- all the payload gets encrypted with aes@...
alwaysInTheBasement's user avatar
0 votes
0 answers
638 views

How do I decrypt an encrypted message with an RSA private key?

I have an encrypted password I must decrypt as part of a challenge. Along with the password came a few UNENCRYPTED RSA private keys From what I understand, all I need in order to decrypt the password ...
burner67671120's user avatar
0 votes
2 answers
211 views

Is there a proof that guarantees strength of password?

Is there any proof that guarantees that a password with specified features (eg. with random special characters, combination of numbers & letters, some length etc) is secure? If there is such a ...
programmer777's user avatar
3 votes
2 answers
2k views

How to securely XOR two passphrases in JavaScript?

Is following approach secure? Planning on using implementation to XOR two passphrases before feeding result to Argon2. ...
sunknudsen's user avatar
1 vote
0 answers
88 views

Password entropy requirements for online dictionary attacks on OPAQUE?

My understanding is that for PAKE protocols such as OPAQUE (https://eprint.iacr.org/2018/163.pdf), the the adversary has no choice but to just do online attacks on the password. If this is true, I ...
Joe's user avatar
  • 73
0 votes
0 answers
31 views

User to be able to log in without stating the user's password scheme possible?

In my database, I have a PBKDF2 hash + salt for every user. My objective is for the user to be able to log in without stating the user's password (in case somebody is logging the network traffic ...
HelloWorld's user avatar
1 vote
1 answer
2k views

Can you break PBKDF2 if you know the hash of the password?

I know that PBKDF2 hashes the password a number of times, the result being a key. Can an attacker find the key if they don't know the password, but know the value of the hash of the password?
user avatar
1 vote
1 answer
526 views

How to create a key for AES in a 192 bit key length from a password?

Let's say that I have a password. And it's secure. But it's a 10-character string. So If I wanted to create an AES key for the 128-bit version of the algorithm I would just hash it using MD5. Or If I ...
aarelovich's user avatar
2 votes
2 answers
183 views

Hashing Passwords and Hash Functions

I'm a complete noob. I was reading up on hash functions. So if a bank has its user password's run through a hash function, it'll produce a unique hash for every password right? Thus, even if hackers ...
user13387446's user avatar

1
2 3 4 5
11