Questions tagged [password-hashing]

Irreversibly converting user-selected passwords into authentication tokens that can be safely stored e.g. in a user database. Typically done with a salted password-based key derivation function (PBKDF), ideally with a memory-hard mixing stage to thwart brute-force attacks using parallel hardware.

Filter by
Sorted by
Tagged with
0
votes
0answers
58 views

Authenticating without sending password to the server, and store data encrypted with password derived key on server

I am trying to think of a scheme that would allow a user to authenticate to a server, whithout sending the password to the server, and to also derive a symetric key on the client (that also never gets ...
13
votes
3answers
2k views

Password entropy much lower than entropy of encryption keys. Why is this acceptable?

When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner. When talking passwords however, the standard these days is ...
-1
votes
1answer
252 views

finding encoding based collision

For example, If I enter as a sample "hello world" in English, then the hashing protocol by encoding the text to binary strings makes the hash. What if I find a word in other languages like Hindi or ...
0
votes
1answer
65 views

Choice of delta-neighbors in Balloon Hash algorithm

Reference Document: https://eprint.iacr.org/2016/027.pdf According to appendix D section 4 definition 27 each vertex in V has predecessors sampled independently and uniformly at random from the ...
2
votes
2answers
2k views

How do I calculate a password space if the password only has eight alphabetic characters (not case sensitive)

I read this wiki article and saw this formula for random password's information entropy. Also the wiki article mention that the symbol count for non case sensitive is 36. Is there a way I can ...
1
vote
2answers
829 views

Password Hashing Security Using Scrypt & Argon2

I am developing an app where the following cryptographic system will be in place: Elliptic Curve key exchange (curve: secp521r1) Double Scrypt the shared secret with different salts Pass this result ...
2
votes
1answer
115 views

pwd-hash like algorithm which can be computed on paper

"Common password problem" is well known problem, when user uses one password for many resources (web sites, logins to computers, etc...) For example, if one web site loses it' database, ...
0
votes
3answers
1k views

Recommended minimum entropy for online passwords in 2018

Assume a simple case, that an attacker knows the password creation scheme, and that we're not dealing with state actors, nor with sites which keep passwords in plain text. We're trying to defend ...
8
votes
1answer
2k views

How to configure Argon2d for commodity hardware?

You may already have heard it: KeePass v2.35 has support for a new database format (KDBX4) which allows for the use of Argon2 (more precisely: Argon2d) as the password-based key derivation function (...
4
votes
2answers
854 views

Key Derivation Functions vs. Password Hashing Schemes

Key derivation functions, such as HKDF (standardized in RFC 5869), are meant to stretch some initial keying material having enough entropy, like a Diffie-Hellman shared value, into one or more strong ...
2
votes
2answers
65 views

Does it make any difference when salting database passwords with Random vs SecureRandom?

I want to salt database passwords and then compute the hash but I wonder if I should use Random or SecureRandom? From an attacker perspective would it be easy to break if Random is used or ...
0
votes
6answers
4k views

Can you use a hash as a password?

There are several methods of making a strong password, making it longer is one of them. now we also have hashing algorithms which have outputs of 512, so i wonder, would it be safe to basiclly use a ...
6
votes
2answers
2k views

Why is PerfectForwardSecrecy considered OK, when it has same defects as salt-less password hashing?

PFS suites suffer from the same defects as any other salt-less password hashing scheme. Why is everyone promoting Perfect Forward Secrecy (PFS) ciphersuites so fiercely? Namely, when the group/hash ...
2
votes
1answer
187 views

Use a hash-function twice

I'm creating a small messenger and I wanted to know if it makes sense to store user passwords double-hashed in our backend-database. I wanted the user the register in an app, which should save a hash ...
3
votes
1answer
48 views

How to get a speedup linear in the number of iterations on unsalted iterated password hashing?

In their 2015 paper "More Rounds, Less Security?" Guo, Jean, Mouha and Nikolić claim in section 5.4 that one can recover a password $P$ given hashes of $D$ different passwords generated from $H^k(P)$ ...
3
votes
1answer
146 views

What are the major advantages of SPHF for PAKE?

I am working on Password Authenticated Key Exchange (PAKE). I noted some PAKE schemes were built upon the smooth projective hash function (SPHF). I am confused why SPHF can be used to design PAKE? I ...
5
votes
1answer
557 views

Why derive keys from a master key instead of generating random keys?

I noticed AWS KMS generates encryption keys based off of a master key, using a key derivation function (HKDF). What's the practical advantage of deriving keys based on a master key? Isn't it simpler ...
1
vote
1answer
82 views

Does encrypting a result of AES block cipher provide more security?

I would like to know if encrypting a result of AES256 block cipher provides more security. Concretely, I am developing a system in which a client sends to a server a ciphertext encrypted with AES256. ...
-1
votes
1answer
150 views

Brute forcing/hacking Secure passphrases - difficulty for random strings vs real words

I was wondering about this topic of brute forcing passwords,or ANY other way to deriving them - and asking myself whats more secure (relatively): A Password which includes A) 30 digits length- a ...
3
votes
2answers
588 views

How difficult is it to guess a salt based on a hash and known plain text?

I have the following use case: Alice owns the domain alice.com and Bob owns bob.com. I want to users to create a hash for ...
24
votes
2answers
5k views

Does the Balloon hashing paper deprecate Argon2?

Does the recent Balloon hashing paper and the included attack on Argon2 effectively negate the result of the Password Hashing Competition? On one hand it seems that only a constant-factor improvement ...
2
votes
3answers
179 views

Deriving a key from a pseudo-random string

I would like to know if deriving a key from a pseudo-random string with a single iteration is secure. Concretely, I am designing a system where a secret key is derived in the client side, and then ...
0
votes
2answers
388 views

Best practices for saving encrypted user data without a database

We are setting up a web application which requires users to submit sensitive data. Since entering all the required data may take a long amount of time, we want to give them the option to save their ...
5
votes
1answer
385 views

Is It Safe to Reuse the Same Salt in Bcrypt Password Hash (Specifically for Chaining Hashes)

As explained in my previous question, I want to develop a scheme which would be able to increase the password hash strength without the user password. According to Thomas Pornin it should be safe to ...
7
votes
1answer
339 views

Are coprocessors (Intel Phi) a threat for modern key stretching functions?

Modern key stretching functions (password-based key derivation functions, also used for password hashing) are memory-hard to mitigate parallel attacks, and as far as I know this is working well. Last ...
5
votes
2answers
448 views

Password derived hash to encrypt known plaintext as password check

The title sounds way too adventurous for what it actually is. I am currently building a system which features some encryption. There is already a system in place, which is built after that scheme if ...
6
votes
2answers
2k views

Argon2 for both password storage and key derivation

Is using Argon2 for both password storage and key derivation secure? I'm planning on using different salt values, of course. The basic concept is something like this: Alice has some secret data ($...
-1
votes
1answer
91 views

How many bits should I request from PBKDF2 to create a strong password?

I'm building a tool which generates passwords by hashing a service name with a master key. PBKDF2 was primarily chosen due to availability in the Web Crypto API. What would be a secure value for the ...
2
votes
1answer
112 views

Are there any known security issues when doing the following chaining of BCrypt Hashes: 'bcryt(bcrypt(user-pw, work-factor1), work-factor2)'

I am currently developing a protocol which would be able to "upgrade" the strength of a bcrypt password hashes without the knowledge of the user-password so a system may upgrade it without user ...
3
votes
1answer
174 views

Secure password-authenticated key exchange that allows for passwords to be stored as hashes, but does not make the hashes password-equivalent

Are there any secure password-authenticated key exchange that allows for passwords to be stored as hashes, but does not make the hashes password-equivalent? This would be useful for many ...
5
votes
1answer
4k views

Pre-image attack on MD5 hash

I read somewhere MD5 is broken in terms of collision, but I am wondering if it is broken in terms of pre-image resistance? Given a hash of Md5, is it possible to find the original message of it? If ...
4
votes
0answers
96 views

Upgrading key derivation by adding a XOR with a known value

In general keys for password based key derivation are derived from a password hash such as the old PBKDF2 function or Argon2, possibly followed by another derivation function to derive data and ...
2
votes
3answers
222 views

Hashing items of different Bytes but same length would enable a timing attack?

I am following this paper which comes highly recommended as a secure Registration/Login system over TLS which uses client side computation for the Password Processing Function (PPF). What my main ...
2
votes
1answer
90 views

Would using a hash of the site name salted with a master password be a secure password for all sites?

I am considering creating an application that is able to work out a unique password for a site by hashing the url while using a secure master password as a salt (or technically pepper since it will ...
2
votes
1answer
3k views

Difference between SSHA512 and SHA512

I am using SSHA512 to encrypt email user's passwords. Manually doing this works using doveadm from dovecot. But I can't seem to implement this in my mail client. I can, however, use SHA512. Is ...
2
votes
1answer
1k views

GUIDs as a salt

Quote: Most of these answers are a bit misguided and demonstrate a confusion between salts and cryptographic keys. The purpose of including salts is to modify the function used to hash each user's ...
20
votes
3answers
12k views

What is the recommended number of iterations for Argon2?

I've recompiled my operating system ("LionBSD" based on FreeBSD) to use Argon2i as the default password hashing algorithm in crypt/libcrypt. I'm wondering what the recommended number of iterations ...
4
votes
1answer
367 views

Reasonable Password Entropy given a certain Set of argon2 Parameters

I followed the recommendation of choosing threads, memory consumption and the number of iterations (in that order) on my machine. But now I wonder which passwords (by means of entropy) are actually ...
2
votes
1answer
266 views

How to prove that a rainbow table is complete?

Passwords that are hashed but not salted can be cracked using the rainbow table. I went through this and this which explains the logic behind rainbow table very well. But I am missing something about ...
1
vote
2answers
87 views

Is it possible to determine the number of characters used for a password used to encrypt a file with AES 128?

I lost a password for an ethereum wallet at the end of 2016. Computer immediately shutdown and password was not recoverable. I know there are many potential avenues for narrowing my search for what ...
0
votes
1answer
383 views

Why does PHP crypt give this unexpected result [closed]

So I have this PHP code,it is meant to encrypt a users password... Three problems/questions: My 'salt' CHANGES ITS NAME I get the same result Is this actually how the result is meant to be? PHP CODE ...
4
votes
1answer
5k views

Traditional DES scheme in Unix crypt function

In a security context course, we need to reproduce the old DES hashing scheme in the crypt program, on an old unix system. I am actually reading the crypt page on wikipedia: The traditional ...
0
votes
1answer
249 views

Hashing user password without database to store salt

I am building an Android app that will run purely locally on the user's device, no servers. It has a database that I want to encrypt with the user's password, which requires a 64 byte key. I've ...
6
votes
0answers
828 views

Argon2 - memory setting - lower bound?

(I realise this is yet another Argon2 "how do I configure" question, but the existing questions I've found don't really help. If I've missed one, happy to have this closed). Deploying Argon2 (with ...
0
votes
1answer
545 views

Having trouble understanding reduction functions in rainbow tables

I'm continuing doing some personal research on rainbow tables, but forsome reason I cannot understand how to choose the correct reduction function. Wikipedia states that "Only when the attacker has ...
0
votes
2answers
2k views

VeraCrypt a weak point [closed]

Biggest flaw in VeraCrypt(or other Encryption programs) is Hash Algorithm. VeraCrypt hashes (SHA,Whirlpool,Streebog) it is the only point where can break an encrypted disk. Because break algorithm (...
1
vote
1answer
140 views

Does having an SHA256 hash compromise PBKDF2 secrecy?

If I have a password pwd, and I hash it with SHA256 and send it to a server for authentication (server will apply ...
1
vote
1answer
102 views

How can a user-input password be used to generate a natural-like dictionary corpus?

I'm curious about the implications of cryptography and the generation of natural text (i.e using Markov chains), and I am wondering if there has been any cryptographic protocols that involved ...
1
vote
2answers
1k views

Should number of iterations of PBKDF2 stay secret?

Let's say I encrypt my passwords with PBKDF2 and store it somewhere. Now let's say it was stolen and the hacker, who stole it knows it was hashed with PBKDF2. Does a knowledge of number of iterations ...
2
votes
2answers
315 views

Why is it recommended to hash passwords with a secret salt?

NIST recommends doing an additional round of hashing using a secret salt: In addition, verifiers SHOULD perform an additional iteration of a key derivation function using a salt value that is ...