Questions tagged [passwords]

Passwords are secret keys which human beings can memorize.

Filter by
Sorted by
Tagged with
3 votes
3 answers
415 views

Password Hashing based on Common Passwords

If an attacker has a database of 1,000 users' hashed passwords which are hashed with SHA-256 with a 128-bit salt and all of these users used 10,000 common passwords. How many hashes will the hacker ...
0 votes
1 answer
48 views

Password space: number of possible password combination

How do I calculate the password space of a randomized linked hybrid pasword of 9 images and 10 numbers(0-9)? User allowed to select 4 password Images=9 Pin= 0-9 Password selection allowed: 4 Every ...
0 votes
0 answers
30 views

Hashes to passwords with PBKDF2

If an attacker wants to hack the passwords of 2^10 users. And all of these users generate a password from the space of 2^50 passwords and each password is hashed with PBKDF2 with 2^10 iterations. How ...
4 votes
2 answers
282 views

Password hashing and salting with SHA-256 on $2^{64}$ password space

If a password is randomly chosen from a space of $2^{64}$ passwords and is stored as an SHA-256-bit hash and a 128-bit salt, how many hashes does an attacker need to perform to recover the password in ...
1 vote
0 answers
56 views

How many hashes to recover a salted password? [closed]

If a password p is selected from a space of 2^64 passwords, and the server stores this as a hash, h = SHA-256(p||s) where s is a random 128-bit salt. How many maximum hashes would an attacker need to ...
0 votes
0 answers
14 views

how VMK is decrypted?

We know that in bitlocker decryption procedure there is an intermediate key after the hash computing phase which used to encrypt nonce using AES-256 and the result (IV) will be used to decrypt VMK. ...
  • 113
2 votes
0 answers
78 views

Algorithm used to generate a BitLocker recovery key

I know exactly how a generated BitLocker recovery key works and I can write a code to brute-force it. How is the recovery key generated though? I could think of some answers: it is generated using an ...
  • 113
1 vote
1 answer
100 views

KEY using AES-128, If P is less than 128 bits, padded with 0 and create 128 bits, any problem if average pw length is 6

For communication between the client and the website, use password (P) as the key using AES-128. If P is less than 128 bits, it is padded with 0 to create a 128 bits key. is there any problem with ...
0 votes
2 answers
92 views

Password encryption in database

I want to store passwords in a database in a way I can reuse them to authenticate users (symmetrical encryption). I read some good information here: https://cheatsheetseries.owasp.org/cheatsheets/...
1 vote
2 answers
91 views

Debug bcrypt iterations with a static salt [closed]

I want to debug bcrypt rounds with a static salt using this python lib ...
  • 113
1 vote
3 answers
218 views

Base64 or hex to attach auth tokens to URL?

I just came across this question, but it does not really answer my main concern that I have regarding password tokens. To authenticate a client who is not logged in; I generate two random tokens and ...
  • 113
0 votes
1 answer
38 views

How easy is it to identifiy the key when knowing a certain number of different AES-256/Fixed Nonce encrypted long-integers

Given some intervals of long integers (64 Bits). I need to generate alphanumeric strings which: should be used like passwords(known only by few individuals) must always be the same for the same ...
  • 111
1 vote
1 answer
82 views

best encryption algorithm for encrypting a string

I am making a password manager , I am new to cryptography, so , can someone tell me if this can be a good solution? 1- the user inputs the email/password 2- all the payload gets encrypted with aes@...
0 votes
0 answers
130 views

How do I decrypt an encrypted message with an RSA private key?

I have an encrypted password I must decrypt as part of a challenge. Along with the password came a few UNENCRYPTED RSA private keys From what I understand, all I need in order to decrypt the password ...
0 votes
2 answers
118 views

Is there a proof that guarantees strength of password?

Is there any proof that guarantees that a password with specified features (eg. with random special characters, combination of numbers & letters, some length etc) is secure? If there is such a ...
3 votes
2 answers
1k views

How to securely XOR two passphrases in JavaScript?

Is following approach secure? Planning on using implementation to XOR two passphrases before feeding result to Argon2. ...
1 vote
0 answers
47 views

Password entropy requirements for online dictionary attacks on OPAQUE?

My understanding is that for PAKE protocols such as OPAQUE (https://eprint.iacr.org/2018/163.pdf), the the adversary has no choice but to just do online attacks on the password. If this is true, I ...
  • 11
0 votes
0 answers
28 views

User to be able to log in without stating the user's password scheme possible?

In my database, I have a PBKDF2 hash + salt for every user. My objective is for the user to be able to log in without stating the user's password (in case somebody is logging the network traffic ...
1 vote
1 answer
642 views

Can you break PBKDF2 if you know the hash of the password?

I know that PBKDF2 hashes the password a number of times, the result being a key. Can an attacker find the key if they don't know the password, but know the value of the hash of the password?
user avatar
1 vote
1 answer
136 views

How to create a key for AES in a 192 bit key length from a password?

Let's say that I have a password. And it's secure. But it's a 10-character string. So If I wanted to create an AES key for the 128-bit version of the algorithm I would just hash it using MD5. Or If I ...
2 votes
2 answers
72 views

Hashing Passwords and Hash Functions

I'm a complete noob. I was reading up on hash functions. So if a bank has its user password's run through a hash function, it'll produce a unique hash for every password right? Thus, even if hackers ...
2 votes
3 answers
100 views

Does encryption of many files shorten the list of possible passwords?

Hopefully this question is not duplicative, nor its answer too elementary. Suppose I have a file. I encrypt it, using a password. The password presumably stipulates a pattern or relationship between ...
0 votes
1 answer
84 views

Using MS Azure to crack password

I heard there is a possibility to perform a brute force attack of an password, I know there is an option to use graphic cards on AWS, but is there a solution for Azure too? Which costs would it take ...
  • 1
0 votes
0 answers
48 views

Public key cryptography for logins

This is a question sparked purely by curiosity, wanting to understand a little more about cryptography and authentication. Thanks in advance to anybody taking their time to answer. Instead of salting ...
1 vote
1 answer
498 views

Is this authentication protocol secure against both eavesdropping and server database disclosure?

Consider the following protocol from the book "Network Security: Private Communication in a Public World" by Kaufman et al. Alice knows a password. Bob, a server that will authenticate ...
1 vote
0 answers
16 views

Is there a known class of techniques about temporary password inaccessibility?

This post asks if a user of a system can restrict their own access in a time-related way. I am interested in this for freezing and unfreezing cryptocurrency accounts to enforce spending controls, but ...
0 votes
1 answer
58 views

How does biometric authentication add protection to encryption schemes?

I'm wondering since at least 2 offline password management services,Passkeep and Keepass both use biometric authentication in addition to the master password. You need to possess the physical device ...
3 votes
1 answer
212 views

Impersonation attack on Lamport's one time password

So here I am, googling my brain on the possibilities of impersonation attempts by a MITM attacker on Lamport's one-time password scheme. Here's my scenario: Say we have a client and server setup. ...
  • 143
1 vote
1 answer
128 views

deterministic password generator idea

Outside of professional carrier, I often stumble upon a need for a unique password for exp. for local database, game server, or on tons of, not so important, websites. I came up with an idea to write ...
0 votes
0 answers
36 views

Keyfiles in password encryption

Some programs use keyfiles as a second factor besides the password. VeraCrypt and its predecessor TrueCrypt, for example, use a function built from CRC-32 that captures the first 1024 bits of a file. ...
  • 903
3 votes
4 answers
5k views

Would this be considered a secure password hash?

I think I've understood properly, but I want to make sure as this will involve money. Password requirement is a minimum of 16 characters and must contain one of each [Upper, Lower, Digit, Other] My ...
0 votes
1 answer
92 views

Is possible to break the encryption on a password by this encryption? [closed]

I wonder if it is possible to break the encryption on a password by such encryption: Where E is the encryption function that uses a known public key of the server.
  • 13
0 votes
1 answer
177 views

DIY: password key derivation tool using PBKDF2 / HMAC

First of all, I don't want to reinvent the wheel, just want to build my own car. Non-product environment; only for fun and entertainment. The goal is to use a single private (and never published) ...
0 votes
1 answer
144 views

How strong would be create a password through AES ECB encryption?

Suppose that I want to use a "poor man" password management working as follows: 1. I choose and remember one single master password (for example "78HK+jm?329"); 2a. for any bank, ...
  • 115
3 votes
2 answers
298 views

How secure is it to share "Passwords" using Shamir Secret Sharing given a way to verify if password is correct?

Lets say you have a order $n$ finite field which you are using to create $k$ shares for a password using Shamir Secret Sharing. Assume that the attacker gets $k-1$ shares. Is it possible that the ...
0 votes
0 answers
29 views

How can I benchmark password strength? [duplicate]

My idea was to balance password entropy and memorability. Is there some tool I can use to benchmark generated passwords? Would a state of the art password cracking tool measuring the time to crack a ...
  • 1
1 vote
0 answers
108 views

Is it safe to use the same password for both VeraCrypt volume and Windows Login?

I encrypted my entire volume with Veracrypt which prompts on start up and asks for a password, great. Now after every startup is finished or everytime I leave the computer unattended (after a quick ...
  • 19
2 votes
2 answers
122 views

What's an algorithm for laypeople to make personal passwords

I'm going to be teaching an audience about algorithms. I'd like to give them one to create unique personal passwords for websites. They could start with the domain name of the site and their own ...
1 vote
1 answer
236 views

Which passphrase length is good so it's hard to break bitcoin's PBKDF2 key?

According to https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#From_mnemonic_to_seed To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in ...
0 votes
1 answer
77 views

How can I convince a legal person that when a password it is possible that it is stored in the plain?

If a used has a password on a system that is 28 ASCII characters, on a system, lets say it's my.gov.au and then a few years ago a flaw is discovered which limits passwords to 20 characters and the ...
0 votes
0 answers
90 views

Hashed password used for encryption and for user authentication at the same time

As I am fairly new to cryptography, I would like to understand how to, in a simple way, implement a system that would achieve the following: the user would have to setup a password, which would then ...
  • 1
3 votes
2 answers
140 views

Concatenation of password and TOTP - possible issues

I have come across a two factor login mechanism using Time based OTP (TOTP). TOTP (6 digits) is shown to the user in an app. There are two ways of logging in. Method 1: User inputs the username and ...
3 votes
1 answer
518 views

Is password hashing post-quantum secure?

Current computers cannot break reasonably strong hashed passwords, for example 14 CSPRNG-generated alphanumeric characters ($\approx$80 bits of entropy). Grover's algorithm applies to hash functions ...
  • 1,426
2 votes
1 answer
88 views

Does grouping password characters for readability decrease entropy?

For example, for a randomly generated password of 28 lowercase letters, which is about 128 bits of entropy, how would adding a space after every four characters affect it? ...
  • 123
1 vote
0 answers
50 views

Is there any “approximate or probabilistic” password authentication method?

I understand that the password-based authorization check procedure requires that you enter a password that is correct, that is, does not allow even a single bit difference. Suddenly I have this ...
6 votes
4 answers
2k views

Make a Strong, Easy-to-Remember Password Using Classical Cryptography?

Passwords can be tough to remember. For example: H7535637353959595*9608J614625C1313^398583I0397897j^ So Bob wants to make and use a good password for GPG that he ...
  • 3,087
1 vote
2 answers
747 views

Crack AES encryption via passphrase dictionary attack?

How easy would it be to crack a AES-256 encrypted file, that is protected by a passphrase? I understand that the trying to brute force a AES-256 encryption key would be on the unfeasible side, even ...
  • 13
0 votes
0 answers
28 views

Is it possible to convert hashed password from one bcypt version to another?

I have passwords hashed using bcypt version \$2a\$ (e.g. "\$2a\$06\$...") and I want to convert them to version \$2b\$ (e.g. "\$2b\$06$..."). Is it possible to do that? If yes, are ...
7 votes
3 answers
3k views

Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw

I have some code that accepts a password in string format, and hash it with SHA3-512 before passing it to bcrypt for hashing. However, by some coincidence, I found a test case that produces a hash ...
  • 173
5 votes
2 answers
1k views

7-Zip Encryption: Practical Effect of Lacking Salt

A previous discussion on Cryptography StackExchange leads me to understand that 7-Zip does not use salt to derive an encryption key from password to use its AES-256 encryption; that this is a ...

1
2 3 4 5
10