The Password-Based Key Derivation Function 2 (PBKDF2) is a method of securely deriving encryption keys from a passphrase entered by a user. It features an iteration count that can be deliberately adjusted (key stretching) to slow down brute force password guessing attacks.

learn more… | top users | synonyms

2
votes
1answer
504 views

A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt

I want a key stretching system that's as strong as the stronger of scrypt and PBKDF2. The consensus now is that scrypt is by far the better system, but that might change if in the future, a weakness ...
2
votes
2answers
626 views

Is scrypt a hashing function, encryption, or PBKDF?

I have installed a python implementation of scrypt and noticed it has several functions, both an encrypt and hash function. Yet Wikipedia lists it as being used for PBKDF instead of PBKDF2. Is scrypt ...
6
votes
3answers
6k views

PBKDF2WithHmacSHA512 Vs. PBKDF2WithHmacSHA1

I'm working on a Java authentication subsystem that specs the storage of passwords in the DB as PBKDF2-generated hashes, and I'm now trying to decide whether I ...
5
votes
1answer
478 views

AES file encryption with PBKDF2. Safe parameters?

I'm developing an application that will use public key authentication to contact some webservice. So the user has his keypair on his computer, and I want that file to be encrypted using AES with a key ...
1
vote
1answer
915 views

Proper way of doing encryption and authentication (PBKDF2 + AES)

I'm currently in the planning phase of an authentication and storage-ish service. The client needs a file ("ENCFILE") which he will work with. This file will be encrypted with AES256, and stored on ...
3
votes
2answers
364 views

bcrypt and pbkdf2 double hashing

If I want to protect myself from implementation of algorithm issues and inherent design flaws of algorithms in password hashing, what would be most secure way to combine two hashes? ...
2
votes
3answers
474 views

Can I dynamically calculate an appropriate number of iterations for PBKDF2 based on the system time, rather than using a fixed value?

Could you choose the number of PBKDF2 iterations based upon the system time? I've heard a few people recommend that the number of iterations for PBKDF2 should be doubled every two years (starting ...
2
votes
2answers
327 views

PBKDF2 uses HMAC-SHA1 to generate keys, but what is the key for the HMAC?

I was reading up on PBKDF2 and noted the following: DK = PBKDF2(PRF, Password, Salt, c, dkLen) PRF is a keyed HMAC, but I can't seem to find out what they use ...
1
vote
1answer
332 views

What's wrong with my security model - or how can it be attacked?

I'm working on a little personal project where security is very important, and I've thought for a while about the best way to do this. Now I am looking for a little outside help on good practices. The ...
5
votes
1answer
1k views

KDF and number of iterations for GPG

I gather, from reading the GPG manual, that symmetric encryption based on a password uses one of a variety of Key Derivation Functions (KDF). Although not explicitly mentioned I assume that PBKDF2 is ...
4
votes
2answers
261 views

How to use salt when there is only one user

I am encrypting files for storage in an untrusted location, using a custom Java program to do that. There is only one user, but there are many files. I am using AES in CBC mode with PKCS5 padding, and ...
2
votes
1answer
202 views

Securely generating passwords based on a secret and a public identifier

I'm trying to create a good scheme for generating passwords in my systems management scripts. What I'd like to do is have a secret key (let's say hello123), which I ...
2
votes
1answer
773 views

Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?

I'm referring the NIST document about PBKDF2, NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation, Part 1: Storage Applications, Page 8 and 9, section 5.4 Using the ...
0
votes
1answer
82 views

PKCS#11: Which CKK_types are supported by CKM_PKCS5_PBKD2?

On Solaris there's a function pkcs11_PasswdToKey() which is a wrapper of C_GenerateKey(). I made a simple test and it turned out ...
4
votes
1answer
400 views

Injecting salt into PyCrypto KDF - useful?

I have noted some sources indicate that when using a KDF like PBKDF2 (alternatively) some advocate injecting the salt at the time of execution - like this: ...
9
votes
2answers
532 views

How to derive two keys from one password

What is the best way to generate two independent symmetric keys from one user-entered password or passphrase? Would using both scrypt and pbkdf2 achieve this?
7
votes
2answers
3k views

What is the difference between Scrypt and PBKDF2?

After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2. As far as I understood, the similarity is: both are password-based key derivation ...
1
vote
1answer
105 views

PBKDF2 when dkLen and hLen have the same size

I was reading RFC 2898 and something is not clear to me. When I use PBKDF2 with SHA-256 and I want a derived key with length 32 bytes (the same length as my hash function output), your derived key ...
10
votes
3answers
2k views

PBKDF2 for key diversification

I am looking for a secure key diversification function to create individual AES keys for a local smart card deployment. The keys need to be derived from a secret master key and the smart card serial ...
6
votes
1answer
1k views

How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?

When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure: Using PBKDF2 with then entire 128 bit ...
8
votes
2answers
3k views

Should I salt an AES password at each encryption?

I saw a sample code where the same password is salted with a different value (using PBKDF2) for each encryption. That means that the salt must be stored for each encrypted message. I don't understand ...
5
votes
2answers
418 views

AES encrypting multiple files

So if I want to encrypt all the files in a folder with AES (same password) I take each file and generate the key schedule using PBKDF2. As the PBKDF2 algorithm takes in a salt then this salt should ...
4
votes
1answer
703 views

Can I use my random IV (for AES) as a salt for PBKDF2?

Also, where do I store my salt (can I just store it at the beginning of the encrypted file)?
11
votes
2answers
766 views

Why is the salt used only once in PBKDF2, while the password is used often?

The purpose of PBKDF2 is to create a derived key (DK) from a master password (PW) and a salt, often using a function like HMAC-SHA256. I have read that the salt should be as random as possible. But ...
5
votes
3answers
821 views

Can I use PBKDF2 for authentication and decryption?

I want to store a hash for authenticating a password. I also want to use the same password for decryption. Can I use PBKDF2 for both? (I plan to use different salts for the authentication and the ...
9
votes
1answer
5k views

How do I store encrypted files on a web server and decrypt them locally?

I want to store files (images) on a public webserver and let users see them if they know a password. The server shouldn't have the unecrypted files and the server can only serve files, not perform ...
7
votes
4answers
9k views

PBKDF2 and salt

I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions. Actually we use the derivation function together with the salt to provide ...
7
votes
3answers
875 views

Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
3
votes
2answers
133 views

KDF with low-entropy salts

I need to derive a key from a username and a password. These are the only two things I have access to. What I thought is using PBKDF2 with username as the salt and password as the master password. ...
4
votes
3answers
1k views

Hash function in PBKDF2

From this excellent answer I learned (correct me if I am wrong) that when writing a block cipher with say key size 128 bit, one has to pad the password given (variable size) so that it becomes exactly ...
2
votes
3answers
490 views

Can PBKDF2 be used to create an XOR cipher key to encrypt random plaintext?

I want to encrypt a truly random plaintext (a key file) based on a user password. I'll use PBKDF2-HMAC-SHA256 to generate an encryption key from the password, but I'm wondering if I even need to ...
3
votes
1answer
254 views

Is there a known vulnerability when using identical key and salt with PBKDF2?

For optimum security, a random salt should be chosen for PBKDF2. I came across a scenario where I produce a hash of a random file that serves as the "password". Due to the nature of files, this has ...
9
votes
1answer
6k views

How do I correctly derive a Key and IV?

Mainly I'm trying to understand how to correctly create the Key and IV for use with the .NET Implementation of AES (AesManaged class). This encryption code will be used in conjunction with existing ...
13
votes
4answers
9k views

How can one securely generate an asymmetric key pair from a short passphrase?

Background info: I am planning on making a filehost with which one can encrypt and upload files. To protect the data against any form of hacking, I'd like not to know the encryption key ($K$) used for ...