Questions tagged [passwords]

Passwords are secret keys which human beings can memorize.

Filter by
Sorted by
Tagged with
0 votes
0 answers
26 views

Password entropy requirements for online dictionary attacks on OPAQUE?

My understanding is that for PAKE protocols such as OPAQUE (https://eprint.iacr.org/2018/163.pdf), the the adversary has no choice but to just do online attacks on the password. If this is true, I ...
user avatar
  • 1
0 votes
0 answers
28 views

User to be able to log in without stating the user's password scheme possible?

In my database, I have a PBKDF2 hash + salt for every user. My objective is for the user to be able to log in without stating the user's password (in case somebody is logging the network traffic ...
user avatar
1 vote
1 answer
340 views

Can you break PBKDF2 if you know the hash of the password?

I know that PBKDF2 hashes the password a number of times, the result being a key. Can an attacker find the key if they don't know the password, but know the value of the hash of the password?
user avatar
1 vote
1 answer
52 views

How to create a key for AES in a 192 bit key length from a password?

Let's say that I have a password. And it's secure. But it's a 10-character string. So If I wanted to create an AES key for the 128-bit version of the algorithm I would just hash it using MD5. Or If I ...
user avatar
2 votes
2 answers
63 views

Hashing Passwords and Hash Functions

I'm a complete noob. I was reading up on hash functions. So if a bank has its user password's run through a hash function, it'll produce a unique hash for every password right? Thus, even if hackers ...
user avatar
2 votes
3 answers
86 views

Does encryption of many files shorten the list of possible passwords?

Hopefully this question is not duplicative, nor its answer too elementary. Suppose I have a file. I encrypt it, using a password. The password presumably stipulates a pattern or relationship between ...
user avatar
0 votes
1 answer
55 views

Using MS Azure to crack password

I heard there is a possibility to perform a brute force attack of an password, I know there is an option to use graphic cards on AWS, but is there a solution for Azure too? Which costs would it take ...
user avatar
  • 1
0 votes
0 answers
38 views

Public key cryptography for logins

This is a question sparked purely by curiosity, wanting to understand a little more about cryptography and authentication. Thanks in advance to anybody taking their time to answer. Instead of salting ...
user avatar
1 vote
1 answer
493 views

Is this authentication protocol secure against both eavesdropping and server database disclosure?

Consider the following protocol from the book "Network Security: Private Communication in a Public World" by Kaufman et al. Alice knows a password. Bob, a server that will authenticate ...
user avatar
1 vote
0 answers
16 views

Is there a known class of techniques about temporary password inaccessibility?

This post asks if a user of a system can restrict their own access in a time-related way. I am interested in this for freezing and unfreezing cryptocurrency accounts to enforce spending controls, but ...
user avatar
0 votes
1 answer
46 views

How does biometric authentication add protection to encryption schemes?

I'm wondering since at least 2 offline password management services,Passkeep and Keepass both use biometric authentication in addition to the master password. You need to possess the physical device ...
user avatar
3 votes
1 answer
147 views

Impersonation attack on Lamport's one time password

So here I am, googling my brain on the possibilities of impersonation attempts by a MITM attacker on Lamport's one-time password scheme. Here's my scenario: Say we have a client and server setup. ...
user avatar
  • 133
1 vote
1 answer
76 views

deterministic password generator idea

Outside of professional carrier, I often stumble upon a need for a unique password for exp. for local database, game server, or on tons of, not so important, websites. I came up with an idea to write ...
user avatar
0 votes
0 answers
28 views

Keyfiles in password encryption

Some programs use keyfiles as a second factor besides the password. VeraCrypt and its predecessor TrueCrypt, for example, use a function built from CRC-32 that captures the first 1024 bits of a file. ...
user avatar
  • 853
3 votes
4 answers
4k views

Would this be considered a secure password hash?

I think I've understood properly, but I want to make sure as this will involve money. Password requirement is a minimum of 16 characters and must contain one of each [Upper, Lower, Digit, Other] My ...
user avatar
0 votes
1 answer
90 views

Is possible to break the encryption on a password by this encryption? [closed]

I wonder if it is possible to break the encryption on a password by such encryption: Where E is the encryption function that uses a known public key of the server.
user avatar
  • 13
0 votes
1 answer
129 views

DIY: password key derivation tool using PBKDF2 / HMAC

First of all, I don't want to reinvent the wheel, just want to build my own car. Non-product environment; only for fun and entertainment. The goal is to use a single private (and never published) ...
user avatar
0 votes
1 answer
93 views

How strong would be create a password through AES ECB encryption?

Suppose that I want to use a "poor man" password management working as follows: 1. I choose and remember one single master password (for example "78HK+jm?329"); 2a. for any bank, ...
user avatar
  • 115
3 votes
2 answers
230 views

How secure is it to share "Passwords" using Shamir Secret Sharing given a way to verify if password is correct?

Lets say you have a order $n$ finite field which you are using to create $k$ shares for a password using Shamir Secret Sharing. Assume that the attacker gets $k-1$ shares. Is it possible that the ...
user avatar
0 votes
0 answers
26 views

How can I benchmark password strength? [duplicate]

My idea was to balance password entropy and memorability. Is there some tool I can use to benchmark generated passwords? Would a state of the art password cracking tool measuring the time to crack a ...
user avatar
  • 1
1 vote
0 answers
80 views

Is it safe to use the same password for both VeraCrypt volume and Windows Login?

I encrypted my entire volume with Veracrypt which prompts on start up and asks for a password, great. Now after every startup is finished or everytime I leave the computer unattended (after a quick ...
user avatar
  • 19
2 votes
2 answers
117 views

What's an algorithm for laypeople to make personal passwords

I'm going to be teaching an audience about algorithms. I'd like to give them one to create unique personal passwords for websites. They could start with the domain name of the site and their own ...
user avatar
1 vote
1 answer
159 views

Which passphrase length is good so it's hard to break bitcoin's PBKDF2 key?

According to https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#From_mnemonic_to_seed To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in ...
user avatar
0 votes
1 answer
77 views

How can I convince a legal person that when a password it is possible that it is stored in the plain?

If a used has a password on a system that is 28 ASCII characters, on a system, lets say it's my.gov.au and then a few years ago a flaw is discovered which limits passwords to 20 characters and the ...
user avatar
0 votes
0 answers
47 views

Hashed password used for encryption and for user authentication at the same time

As I am fairly new to cryptography, I would like to understand how to, in a simple way, implement a system that would achieve the following: the user would have to setup a password, which would then ...
user avatar
  • 1
3 votes
1 answer
96 views

Concatenation of password and TOTP - possible issues

I have come across a two factor login mechanism using Time based OTP (TOTP). TOTP (6 digits) is shown to the user in an app. There are two ways of logging in. Method 1: User inputs the username and ...
user avatar
2 votes
1 answer
256 views

Is password hashing post-quantum secure?

Current computers cannot break reasonably strong hashed passwords, for example 14 CSPRNG-generated alphanumeric characters ($\approx$80 bits of entropy). Grover's algorithm applies to hash functions ...
user avatar
  • 1,376
2 votes
1 answer
84 views

Does grouping password characters for readability decrease entropy?

For example, for a randomly generated password of 28 lowercase letters, which is about 128 bits of entropy, how would adding a space after every four characters affect it? ...
user avatar
  • 123
0 votes
0 answers
63 views

Are there any best practices/recommendations for/against using client-side password hashing?

I do not mean generating a hash on the client side and then storing it in the database directly. I found a few questions with similar theme, but most of those answers assumed a scenario where ...
user avatar
1 vote
0 answers
46 views

Is there any “approximate or probabilistic” password authentication method?

I understand that the password-based authorization check procedure requires that you enter a password that is correct, that is, does not allow even a single bit difference. Suddenly I have this ...
user avatar
6 votes
4 answers
2k views

Make a Strong, Easy-to-Remember Password Using Classical Cryptography?

Passwords can be tough to remember. For example: H7535637353959595*9608J614625C1313^398583I0397897j^ So Bob wants to make and use a good password for GPG that he ...
user avatar
  • 3,057
1 vote
2 answers
519 views

Crack AES encryption via passphrase dictionary attack?

How easy would it be to crack a AES-256 encrypted file, that is protected by a passphrase? I understand that the trying to brute force a AES-256 encryption key would be on the unfeasible side, even ...
user avatar
  • 13
0 votes
0 answers
27 views

Is it possible to convert hashed password from one bcypt version to another?

I have passwords hashed using bcypt version \$2a\$ (e.g. "\$2a\$06\$...") and I want to convert them to version \$2b\$ (e.g. "\$2b\$06$..."). Is it possible to do that? If yes, are ...
user avatar
7 votes
3 answers
3k views

Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw

I have some code that accepts a password in string format, and hash it with SHA3-512 before passing it to bcrypt for hashing. However, by some coincidence, I found a test case that produces a hash ...
user avatar
  • 173
5 votes
2 answers
797 views

7-Zip Encryption: Practical Effect of Lacking Salt

A previous discussion on Cryptography StackExchange leads me to understand that 7-Zip does not use salt to derive an encryption key from password to use its AES-256 encryption; that this is a ...
user avatar
1 vote
2 answers
184 views

Would hashing a password twice prevent naive attacks?

A common way of using MD5 or any other hashing algorithms to store passwords is to hash the password with a salt $$\text{hash}(\text{password} \mathbin\| \text{salt}).$$ This way, if an attacker wants ...
user avatar
1 vote
1 answer
217 views

BIP 39: If I mix my 24 seed phrase with another 24 words, will the checksum property allow an attacker to retrieve the original seed phrase?

Assume that I have a 24-word passphrase that I want to store securely but online by mixing it with another 24 words in a manner only I know. Does the checksum property somehow help an attacker to ...
user avatar
  • 13
3 votes
2 answers
135 views

Why does the PAKE ideal functionallity allow the keys to be the same when the passwords differ?

My intuition for the security a symmetric PAKE is supposed to provide comes from the example of a login page. Both the user and the server know the password (assuming unhashed passwords), and the ...
user avatar
  • 223
0 votes
1 answer
129 views

In Microsoft Password Monitor implementation using HME how do they perform ComputeMatch Function?

https://www.microsoft.com/en-us/research/blog/password-monitor-safeguarding-passwords-in-microsoft-edge/ In this they mention The server then evaluates a matching function on the encrypted credential,...
user avatar
1 vote
1 answer
213 views

Do I need a salt for Scrypt if the data is client-side?

I have a web app, in which I am encrypting user data client side. Each client has their own password, which is used to derive an encryption key (via Scrypt) for encrypting their data. Since the data ...
user avatar
  • 421
2 votes
1 answer
351 views

Is tagging the hash of a password along with ciphertext secure?

Suppose I have a password, in which I use Argon2ID with 1GB memory to derive an encryption key. Then, I encrypt my data using XChaCha20 using that encryption key. The problem with ChaCha is that any ...
user avatar
  • 421
1 vote
0 answers
86 views

Dragonfly masked DH

I was looking at Dragonfly key exchange protocol RFC 7664, and it seems to make use of masked Diffie-Hellman in the final part. Generating two random numbers less than group order $q$, $m$, and $r$ ...
user avatar
33 votes
8 answers
11k views

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

I'm not even sure if they are serious, but I've heard many times that some people refuse to not only trust their computer to generate a random string (which is understandable) but also don't trust ...
user avatar
  • 363
1 vote
2 answers
395 views

How long would it take all of the supercomputers or cloud computing on Earth to bruteforce a significantly long password?

I was arguing with a colleague who thinks that SHA256 (password + 64 character static salt) is "insecure." My argument is that nothing in cryptography is "secure," it's all a ...
user avatar
0 votes
2 answers
77 views

Is this method of salting effective?

So this is my first post on this forum, so bear with me if I sound stupid. I am creating my own web application with JavaScript and MongoDB. I am storing all user information in a Mongo table, and ...
user avatar
1 vote
1 answer
176 views

Can ECDSA signature signing and verification process replaces password hashed based login system?

ECDSA or DSA in general was to sign a message or data using private key and verify it using public key, if the attacker/imposter doesn't have the private key then they couldn't sign the message ...
user avatar
  • 91
1 vote
1 answer
78 views

Where to obtain a common/weak password list (black list)?

The NIST 800-63B publication specifies recommendations regarding memorized secrets (passwords) https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver specifically section "5.1.1 Memorized ...
user avatar
  • 171
0 votes
0 answers
36 views

Number of combinations with a max. of successively repeated characters

I would like to calculate the possible password combinations for a password that is 60 characters long, has the letters a-f and numbers 0-9. Also no character should repeat successively more than 7 ...
user avatar
  • 1
0 votes
0 answers
48 views

What is the purpose of hashing the identifier in the secure remote password (SRP) protocol?

In the secure remote password protocol version 6a, the identifier for the user, I, is hashed along with the salt and the password on the client. While I understand ...
user avatar
  • 1
1 vote
1 answer
80 views

Is this mentally computable password system, cryptographically secure? And anything like this out there I can find?

Please bear with me on this, I'm not learnt in this field, just trying to ask questions about the security of my encryption method. I'm trying to create a mentally computable human password manager ...
user avatar

1
2 3 4 5
10