Tag Info

New answers tagged

3

I don't think it is a good idea, for two main reasons. Firstly, you are basing your security on the obscurity of a parameter that was not designed initially for being secret, which is a risky practice. It is similar to hiding the salt. Secondly, following your example, you may in principle think that a random number of iterations between 10 and 100,000 is ...


1

SOJPM already noted in the comments format-preserving encryption (Wiki Link), that should do the trick. Simply speaking, FPE allows you a proper encryption method based on any arbitrary subset you want. In your case, that would be the common symbols in filenames, although you might want to be more restrictive to limit yourself to alphanumeric values. FPE ...


1

With a KDF meeting its objectives, the only way the leak of the persisted key compromises the confidentiality of the other is correctly identified in the question: a password guess can be checked at the cost of one evaluation of the KDF based on the leaked key and its corresponding salt (and assuming the password's entropy is significantly less than the ...



Top 50 recent answers are included