Reputation
Next privilege 15 Rep.
Flag posts
Badges
1
Newest
 Student
Impact
~30 people reached

  • 0 posts edited
  • 0 helpful flags
  • 0 votes cast
Nov
29
comment StoredKey in Salted Challenge Response Mechanism (SCRAM)
So what you're saying is that the reason we need key stretching from PBKDF2 is because passwords generally have low entropy, but because we're hashing the output of PBKDF2, we don't have to worry about brute forcing and rainbow tables and the like in this case?
Nov
28
comment StoredKey in Salted Challenge Response Mechanism (SCRAM)
@MaartenBodewes Sorry perhaps I wasn't clear, I know the stored key isn't H(PlaintextPassword), I was merely using it as a way of comparison. The relevant parts of the RFC are: SaltedPassword := Hi(Normalize(password), salt, i), ClientKey := HMAC(SaltedPassword, "Client Key"), StoredKey := H(ClientKey). Ultimately the step between ClientKey and StoredKey is a single hash operation. Perhaps there's something I'm missing that makes extra safety here unnecessary?
Nov
28
awarded  Student
Nov
28
asked StoredKey in Salted Challenge Response Mechanism (SCRAM)