125 reputation
4
bio website
location
age
visits member for 3 years, 2 months
seen Jun 12 at 23:41

Aug
8
awarded  Scholar
Aug
8
accepted Looking for cryptographic secure hash algorithm(s) that produces identical root hash for differently sliced hash list
Aug
8
accepted Securing content and login with “same” password
Aug
7
comment Securing content and login with “same” password
I think that's it. SRP would be nice but there don't seem too many implementations out there (and implementing ourselves is too work intensive and fraught with risk of compromising security by screwing it up). Server stored salt with username + salt + password for authentication seems to be the way to go. It still allows attackers to guess usernames (as I need a method to get the salt for a user name without authentication) but that's probably acceptable.
Aug
7
comment Securing content and login with “same” password
Regarding PAKE, thanks for the pointer, haven't heard of it before. Am I right to assume that it does not require the client to disclose the password to the server (otherwise it would be useless as password for subsequent PBKDF).
Aug
7
comment Securing content and login with “same” password
Isn't the risk of learning P from knowing H(P) the same as it would be for any service that stores password hashes for authentication?
Aug
7
comment Securing content and login with “same” password
The server doesn't need to store H(P). I would expect it to treat it like any other user password and store some hashed version of it, i.e. store something like H'(H(P)).
Aug
7
revised Securing content and login with “same” password
added 143 characters in body
Aug
7
comment Securing content and login with “same” password
I understand the limitations of password based encryption - i don't have a choice in this case. What my questions is about, is whether the proposed scheme is worse than password based encryption is at best of times.
Aug
7
asked Securing content and login with “same” password
Aug
28
awarded  Student
Aug
25
comment Looking for cryptographic secure hash algorithm(s) that produces identical root hash for differently sliced hash list
@Marsh Good point, and I have to see how effective it will be in real life. In my application I think there is some hope: The system is providing a secure space for collaboration. The keys are being managed centrally (but independently of the storage). So, within a collaborating group it is possible to give one user a reference to data and keys of another user.
Aug
24
awarded  Supporter
Aug
23
awarded  Editor
Aug
23
revised Looking for cryptographic secure hash algorithm(s) that produces identical root hash for differently sliced hash list
added 566 characters in body
Aug
23
comment Looking for cryptographic secure hash algorithm(s) that produces identical root hash for differently sliced hash list
Thanks for the very detailed answer. I'll have to do some thinking if I can apply it to my use case. I'll add the use case to the questions as well to make it more specific.
Aug
23
asked Looking for cryptographic secure hash algorithm(s) that produces identical root hash for differently sliced hash list