In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
From this excellent answer I learned (correct me if I am wrong) that when writing a block cipher with say key size 128 bit, one has to pad the password given (variable size) so that it becomes exactly ...
For optimum security, a random salt should be chosen for PBKDF2. I came across a scenario where I produce a hash of a random file that serves as the "password". Due to the nature of files, this has ...