Tag Info

11

Actually, it turned out that scrypt was not as good as initially advertised under all conditions. Scrypt was designed to support the specific case of password-based key derivation for full harddisk encryption. Basically, you type your password when the machine boots up (or awakes from hibernation). This is a context where the following apply: The password ...

5

I guess the honest answer is nobody can know for sure, however: There's a general rule of thumb in cryptography, that once there was been wide rewards for breaking an algorithm (be it a hash function, a cipher or in this case a key deviation function) but nobody has come to close the breaking it, then we are in the "safest period". Scrypt is almost ...

3

Yes, this is secure, even though scrypt uses PBKDF2 inside. PBKDF2 has the issue that it the work factor is required $n$ times where $n$ is the number hash outputs concatenated to create the final PBKDF2 output. That means that if you can check the validity of PBKDF2 using only the initial bits (in your case used for the key if the hash was SHA-256, for ...

3

I don't think it is a good idea, for two main reasons. Firstly, you are basing your security on the obscurity of a parameter that was not designed initially for being secret, which is a risky practice. It is similar to hiding the salt. Secondly, following your example, you may in principle think that a random number of iterations between 10 and 100,000 is ...

2

I know PBKDF2 is essentially "useless" against anyone with a GPU rig and I have read that bcrypt is "useless" to anyone with an FPGA setup. Neither is useless. Newer alternatives like scrypt and the eventual PHC winner make better use of the defenders' resources, but even a thousand iterations of PBKDF2 is useful, compared to doing nothing. If you ...

1

SCrypt is a Password Based Key Derivation Function or PBKDF. In general you don't need such a function if your input is already a key. In that case you need a Key Based Key Derivation Function - a KBKDF. Currently the best KBKDF is probably HKDF. This can take a key (e.g. the public key), info (e.g. $i$ or the hash over $i$) and possibly a salt. As it is ...

1

If you're using node, node scrypt does this much nicer than your standard Nrp parameters: scrypt.params(maxtime, maxmem, maxmemfrac, function(err, scryptParameters) { // scryptParameters contains the standard Nrp generated based on your inputs }); This way you can control your parameters in a much more understandable way, putting limits on how much ...

1

Server shouldn't know plain password If the user types their password into a web page in a browser, the server that hosts that web page always has the opportunity to see what password was entered. There's no cryptographic mechanism that can prevent that (at this point in time). To get around this limitation, you need to build a downloadable ...

Only top voted, non community-wiki answers of a minimum length are eligible