Questions tagged [password-based-encryption]

Encryption using a key derived from a password or passphrase entered by the user.

Filter by
Sorted by
Tagged with
126
votes
5answers
112k views

What is a cryptographic “salt”?

I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it. Can I get a ...
14
votes
2answers
1k views

How to derive two keys from one password

What is the best way to generate two independent symmetric keys from one user-entered password or passphrase? Would using both scrypt and pbkdf2 achieve this?
13
votes
1answer
3k views

When to use Argon2i vs Argon2d vs Argon2id?

I've read the manual, and multiple articles / StackExchange posts about this topic, but still can't decide which implementation of Argon2 is best for my use case. I want to securely encrypt passwords ...
2
votes
3answers
305 views

Securing content and login with “same” password

I'm writing a client application that wants to store some secret information with a storage service. The client has to authenticate the user with the service and the service should not be able to ...
19
votes
2answers
856 views

Is there any SRP-like key exchange only using “standard” cryptographic primitives?

I am looking into PAKEs (password-authenticated key exchanges), and it seems like SRP (Secure Remote Password) is essentially the de-facto standard. However, implementing SRP actually requires doing ...
16
votes
4answers
29k views

Is password-based AES encryption secure at all?

For a few years I have put all my passwords in a text file and encrypted that file with a password using a software solution (Axcrypt) which uses AES-128. The password is not really strong, but I ...
5
votes
0answers
505 views

Is there a “brainwallet” for GPG keys? [closed]

“Brainwallet” is a program that takes a passphrase (hopefully a good one) and deterministically creates a Bitcoin wallet. This wallet can be used for transactions, then deleted from the computer. To ...
4
votes
1answer
152 views

Security limits of password-based encryption

A reasonable way to do password-based encryption is: put the passphrase¹ and nonce in a well-parametrized memory-hard iterated hash function like Argon2, to derive a key 128-bit or larger. output the ...
7
votes
1answer
270 views

How to generate a key using any $m$ passwords out of total $n$?

My application requires an AES-256 key K for some secure operation. In order to avoid saving this key in application, I have implemented following scheme: There ...
9
votes
3answers
19k views

Best way to generate a IV for AES-CBC when encrypting files?

The situation is that I want to use symmetric encryption to store some info in files. I'm going to use AES-CBC algorithm. The user is going to remember the password (meaning it will not be stored ...
5
votes
1answer
353 views

Is it safe to derive two different keys with the same password and key derivation function using two different salts?

I would like to know if the following process would harm the security of a fictional system if the persisted data would be stolen: in this system a user has a single password. The password will be ...
4
votes
2answers
365 views

Using PBKDF2 twice with different argument order

I'm pretty sure this is a really bad approach (in theory), but one of my clients is doing this and I was wondering… How bad it is to perform pbkdf-2 in this way (with 2000 iterations)? ...
3
votes
1answer
491 views

How does ccrypt work?

On many Linux/GNU distributions CCrypt (ccrypt) by Peter Selinger is available as a command line utility to encrypt files. How does the protocol work and is it ...
2
votes
2answers
839 views

Does AES-GCM without security tag turn into regular CTR Mode?

We are looking to implement a simple password based key agreement scheme. Part of this is deriving a symmetric key from a common passphrase known to both parties involved. This symmetric key is then ...
1
vote
1answer
567 views

Which algorithm do you recommend for practical use to generate unique passwords for each website?

So, in my imagination there is this simple algorithm with only one master password, let's say a prime number 'p', which I have to remember. Using only the address of the website and p, the algorithm ...
6
votes
2answers
3k views

Encryption Key derivation from numeric PIN?

I want to store data encrypted within an Android application. Keeping an encryption key safe outside the app is not an option so I looked into password derived key algorithms. I found a nice example ...
3
votes
1answer
2k views

Rfc2898DeriveBytes - password length

Trying to find related answer for a long time, but not convinced yet. What I am trying is to encrypt using RijndaelManaged. To create Key, I am passing password, ...
1
vote
1answer
114 views

Do all PAKE assume that all parties already have a password?

I was looking for a means to perform a key exchange without relying on a PKI. I discovered Password Authenticated Key Exchange (PAKE) and after reading J-PAKE; I have the following questions: Do PAKE ...
1
vote
2answers
160 views

In SRP, is the client protected from server impersonation?

Assume use of SRP over an otherwise insecure unauthenticated channel where the user running the client side has chosen a password, the user only uses that password with a trusted SRP client software, ...
1
vote
1answer
179 views

An efficient PACE protocol with curve25519

The PACE protocol is a password authenticated key agreement which is widely used. For instance, in the electronic ICAO passports as the so called SAC protocol. PACE is standardised in ICAO DOC9303 ...
0
votes
3answers
2k views

how much is secure to encrypt a password using itself (as encryption key) for storing it on an insecure media?

I want to store a password securely on a storage (suppose in a usual unencrypted file). I use this password as AES key to encrypt itself (using AES-ECB) & then store it on the media (the password ...