# Tag Info

5

As K.G. and nightcracker note, the reason we don't recommend this method of password storage is that it becomes insecure if the secret $k$ is compromised. Given that the whole point of password hashing is to protect the passwords in the event that your server is compromised, it's generally not safe to assume that the compromise won't include the secret key ...

3

Quite a difficult question. What you seem to need is a one-way permutation $P$. Indeed, suppose you have it of width $d$, then consider the function $$F(K,S,R_S) = E_{K_2}(P(E_{K_1}(S,R_S))),$$ where $E$ is any good 64-bit block cipher (say, Simon) and $K_1,K_2$ are derived from $K$. This function $F$ should fulfill (2) because of the encryptions of both ...

2

What the specification is saying is that prior to processing, the message is padded to a full block length, with the empty message padded to a single block. The spec on page 4 describes the input into the algorithm as: Define $||a||_n = max\{1, \lceil|a|/n\rceil \}$, where the empty string counts as one block Let $m = ||M||_n$ Partition $M$ into $M[1] ... ... 1 The usual way to encode long random bitstrings, so that they can be easily memorized and/or entered by humans, is to break them into blocks of (typically) 10 to 12 bits and map each block to an entry in a fixed dictionary of common words. This approach is commonly used for secure passphrase generation, e.g. by Diceware, S/KEY and PGP. Assuming an 11-bit ... 1$Poly1305_{k,r}(N,M)$is a Carter-Wegman nonce-based MAC, whose security crucially depends on the uniqueness of nonce$N$for every message$M$. It is defined as $$Poly1305_{k,r}(N,M) = f(M,r) + AES_k(N),$$ where$f(M,r)$is a polynomial of$r$with coefficients derived from the binary representation of$M$, and$AES_k(N)$is the encryption of nonce$N$... 1$Poly1305_{{r,s}}(m)$is a one-time authenticator - it can be used to authenticate only a single message with any given key$(r,s)\$ without violating the security guarantees (the violation is immediate - only two authenticated messages with the same key are required to create a forgery according to the nacl docs). There are two 128 bit key values to this ...

Only top voted, non community-wiki answers of a minimum length are eligible