All Questions
Tagged with password-hashing password-based-encryption
27 questions
0
votes
1
answer
89
views
database encryption scheme salt storage
I'm thinking about a page-level encryption scheme for a database, the general structure would be something like the following:
Derive KEY from PASSWORD and SALT using libsodium's Argon2ID
Encrypt ...
0
votes
1
answer
2k
views
When trying to break a PBKDF2 SHA512 hash, how fast is an RTX 4090 or similar GPU with the given parameters
I'm writing a paper for uni about password security, specifically about cracking passwords in the context of a password manager. I've coded a password encryption scheme which uses PBKDF2(SHA512) to ...
1
vote
0
answers
91
views
Custom key for key wrapping using JOSE/JWK
I am trying to figure out how to use a custom password with a JWK that uses the password for key wrapping. The JWA spec contains for example "PBES2-HS512+A256KW", which does "PBES2 with ...
- 121
4
votes
2
answers
640
views
Does combining multiple PBKDF2 keys result higher iteration count when using same password but different salts?
I did some experimenting with web subtle crypto.
I derived a key using PBKDF2 with SHA-512 and 100 000 iterations and timed it.
Doing same with 200 000 rounds doubled the time as expected.
Then I did ...
- 43
0
votes
0
answers
116
views
Hashing and Password Cracking
I was playing a game on cryptography where I encountered this problem:
Hashed Value of password: 24 109 76 35 22 94 83 25 106 104 73 87 56 38 56 50 10
92 58 84 44 88 24 112 125 121 125 43 122 55 106 ...
- 111
0
votes
0
answers
57
views
Public key cryptography for logins
This is a question sparked purely by curiosity, wanting to understand a little more about cryptography and authentication. Thanks in advance to anybody taking their time to answer.
Instead of salting ...
- 1
1
vote
0
answers
488
views
Hashed password used for encryption and for user authentication at the same time
As I am fairly new to cryptography, I would like to understand how to, in a simple way, implement a system that would achieve the following: the user would have to setup a password, which would then ...
- 11
7
votes
3
answers
3k
views
Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw
I have some code that accepts a password in string format, and hash it with SHA3-512 before passing it to bcrypt for hashing. However, by some coincidence, I found a test case that produces a hash ...
- 173
1
vote
0
answers
4k
views
Relation between Zoom id,password and join URL [closed]
We all are using zoom application for joining/hosting meetings in this corona virus period. As we create a meeting, a new id, password and a url is generated. Some real examples follow-
Id: ...
- 111
2
votes
5
answers
729
views
How passwords are fed to key derivation functions?
Suppose I want to encrypt data, send it over the network, and decrypt it on the receiver side.
I know the elegant way to do this is by using a symmetric key to encrypt the data and an asymmetric key ...
- 123
1
vote
1
answer
2k
views
Argon2 or scrypt instead of PBKDF2 with AES
Is using scrypt or argon2 a better key stretching technique with AES compared to PBKDF2 or bcrypt with regards to
a quantum computer brute force attack. The brute force attack I'm referring to is ...
- 111
5
votes
1
answer
193
views
How would quantum computers affect password based encryption?
At first glance: Assuming that the output of the password hashing function is large enough,
quantum computers should have no effect on password encryption as on symmetric cryptography in general.
Is ...
- 995
29
votes
1
answer
20k
views
When to use Argon2i vs Argon2d vs Argon2id?
I've read the manual, and multiple articles / StackExchange posts about this topic, but still can't decide which implementation of Argon2 is best for my use case.
I want to securely encrypt passwords ...
- 393
0
votes
0
answers
86
views
Authenticating without sending password to the server, and store data encrypted with password derived key on server
I am trying to think of a scheme that would allow a user to authenticate to a server, whithout sending the password to the server, and to also derive a symetric key on the client (that also never gets ...
- 101
0
votes
2
answers
931
views
Best practices for saving encrypted user data without a database
We are setting up a web application which requires users to submit sensitive data. Since entering all the required data may take a long amount of time, we want to give them the option to save their ...
- 109
8
votes
2
answers
4k
views
Argon2 for both password storage and key derivation
Is using Argon2 for both password storage and key derivation secure? I'm planning on using different salt values, of course.
The basic concept is something like this:
Alice has some secret data ($...
- 83
5
votes
0
answers
141
views
Upgrading key derivation by adding an XOR with a known value
In general, keys for password-based key derivation are derived from a password hash such as the old PBKDF2 function or Argon2, possibly followed by another derivation function to derive data and ...
- 94.5k
1
vote
2
answers
245
views
Is it possible to determine the number of characters used for a password used to encrypt a file with AES 128?
I lost a password for an ethereum wallet at the end of 2016. Computer immediately shutdown and password was not recoverable.
I know there are many potential avenues for narrowing my search for what ...
- 11
1
vote
1
answer
224
views
Does having an SHA256 hash compromise PBKDF2 secrecy?
If I have a password pwd, and I hash it with SHA256 and send it to a server for authentication (server will apply ...
- 123
2
votes
0
answers
75
views
Did "The Catena Password-Scrambling Framework" make an error in the reduction of its pseudorandomness?
I was reviewing the most recent version of the Catena paper and they made some claims that I find questionable in their reduction of the pseudorandomness of the output of Catena (p. 32). First I will ...
user58013
1
vote
2
answers
344
views
Zencash uses your passphrase to identify AND unlock a wallet - how is this secure?
When looking into Zencash I stumbled into myzenwallet.io (by the Zencash creators), which gives you the option to enter a passphrase to generate a wallet (seems normal), but then after creating your ...
- 113
0
votes
2
answers
38
views
Prevent communication with a node assuming full transparency
I have an IoT device that I have set up to communicate with AES-256-GCM encryption. The working version has the encryption key stored in plaintext in a file on the device (this is going to be improved)...
- 161
5
votes
2
answers
797
views
Password derived hash to encrypt known plaintext as password check
The title sounds way too adventurous for what it actually is. I am currently building a system which features some encryption. There is already a system in place, which is built after that scheme if ...
- 151
1
vote
1
answer
898
views
Question about hashing passwords with PBKDF2
I am new here and new to encrypting and securing passwords, so please forgive me if this question is not posted to the right location or if my question is bad.
I have been working on a web app in ...
- 111
1
vote
1
answer
960
views
storing salt in app
I want to create a key for my realm database wich work with AES-256 and for encryption wants a byte[64] key.
I read this good question about create a key from 4 ...
- 111
1
vote
1
answer
299
views
securing the keystore
When generating a public-private key pair you have the option to secure the keystore with a password.
where is that password stored, is it a hashed version that is stored and if that is so which ...
- 155
-1
votes
2
answers
151
views
What if I make the hashing with an own function ? Does it make unhackable?
I am thinking to create own hashing Instead of creating encryption(weak). That hash function has some number of cryptic parameters to go before it stores in db? Does it become unhackable if I do so?
