Tag Info

New answers tagged

1

Server shouldn't know plain password If the user types their password into a web page in a browser, the server that hosts that web page always has the opportunity to see what password was entered. There's no cryptographic mechanism that can prevent that (at this point in time). To get around this limitation, you need to build a downloadable ...


1

I generate a derived key for every document via KD=KDF∗KM∗filename where KDF and filename are known to the public. If I brute-force a document and get the correct KD, I know 3 out of 4 variables and therefore know KM. As a result, I’m able to derive every KD. The main problem here is, that you assume the existence of a function, which can calculate the ...


1

Yes, key derivation with known parameters can add to security. For a start, in the scenario of the question (understood as a real-world scenario, with PDF encryption used in step 4), when key derivation is used, you can hand one encrypted PDF document and its derived key to a person, and that won't enable her to decipher other enciphered documents; this ...



Top 50 recent answers are included