1
$\begingroup$

System based on, e.g.:
PBKDF2, ECDSA and authenticator's random challenges.

Key derived from a password would be ECDSA's private key used to sign random challenges.

Is password brute force the only thing I should worry about or is there another threat involved with using such key as a ECDSA seed?

$\endgroup$
1
$\begingroup$

How are you going to trust the resulting public key that is required to verify anything signed by the private key?

How are you going to maintain security after you've authenticated?

ECDSA may be vulnerable against analysis using quantum computing.


You've only partly described one part of a cryptographic system. This means you've got plenty to worry about.

$\endgroup$
  • $\begingroup$ "How are you going to trust the resulting public key that is required to verify anything signed by the private key?" That is my question, can I trust that public key since it's not from random data but from PBKDF2? Or am I only worrying about password brute force? True, quantum computing is one I didn't think about. Maintaining security after authentication is completely different thing. $\endgroup$ – dnmx Sep 1 '16 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.