Tag Info

New answers tagged

3

Actually you are quite near on implementing PBKDF2. It is kind of iterated HMAC execution. So have a look here and just implement the missing parts: PBKDF2


1

all those concerns have been studied a lot and still are. I'll try to give some keywords for them. a web app that stores all data on the server in a way that the server can't decrypt the data even if it wanted to. Solution for this is User-side encryption. That's why, forget about the server chosing the encryption key himself. It's quite well spread ...


0

First observe that the password is all that protects the user's data from the server. There is no security added by the public and private keys. Here's a simple solution that should work reasonably well. It may even be secure... Assumptions We rely on a secure symmetric cryptosystem $(E,D)$ that supports authenticated data, that is, $c = E(k, ad, m)$ and ...


1

If you put the text content of the webpage encrypted into HTML5 local storage, IndexedDB or embedded as a hex/base64 string in the web page, then you you could try something like TripleSec which would take your password, run a PBKDF and decrypt the content. Or you can use one of the many JavaScript libraries CryptoJS, SJCL etc and do it yourself manually. ...


-1

If you're doing this entirely client-side, it's trivial for someone to bypass it. You can't really use the user's computer to keep something from them. That's the problem DRM tries to solve, and even with the full cooperation of the OS to keep things from the user it doesn't work perfectly. Javascript can't do that at all; you need to do encryption on the ...


1

Since your HMAC key is held in the same database as the passwords you shouldn't count on it to do anything... If the attackers get the passwords, they get the HMAC key. So HMAC doesn't prevent brute forcing, and a password hashing function would provide both points 1 and 2 above. Depending on your timeline you may want to consider using whatever function ...



Top 50 recent answers are included