New answers tagged pbkdf-2
0
I am not familiar with that specific Solaris library (is that a software token?).
However, what I can say is that PKCS#11 does not set any minimum requirement for the algorithms that a certain implementation should offer. CKK_IDEA could be supported, but only if the implementer chooses to. For instance, up to a few years ago, IDEA was patented and it was ...
7
Identical passwords will still get unique PBKDF2 hashes given a unique salt, regardless of which mechanism you use.
I don't think explicitly adding the salt improves the security of this scheme. The designer PBKDF2 have already considered and solved this problem. There is no need for you to try to duplicate their efforts.
I think it's safer to use the ...
3
Yes, scrypt achieves this. Scrypt has a variable-length output, so just generate as much output as you need. For instance, you can ask it for 256 bits of output, then use the first 128 bits for one key and the second 128 bits for the other key.
While PBKDF2 also has a variable-length output, I do not recommend that you use it in the same way. It has a ...
4
Both scrypt and pbkdf2 have variable length outputs, and each bit of the output is effectively independent on every other bit. So, one obvious way would be just to ask for enough output for both keys. For example, if the two keys are each 128 bits, then ask scrypt (or pbkdf2) for 256 bits of output; use the first 128 bits as the first key, and the second ...
10
Both PBKDF2 and scrypt are key derivation functions (KDFs) that implement key stretching by being deliberately slow to compute and, in particular, by having an adjustable parameter to control the slowness.
The difference is that scrypt is also designed to require a large (and adjustable) amount of memory to compute efficiently. The purpose of this is to ...
2
Scrypt depends more on being a "Memory-Hard algorithm" as seen under section 2 here.
PBKDF2 relies more on increasing CPU requirements by adding iterations.
A good high level explanation of how KDFs like bcrypt/scrypt work is seen here. Also check out this explanation for a little more detail.
Top 50 recent answers are included
