Questions tagged [passwords]
Passwords are secret keys which human beings can memorize.
506
questions
2
votes
1
answer
33
views
Cache-hard or memory-hard password hashing algorithms?
bscrypt is a cache-hard password hashing algorithm/KDF from Steve Thomas (aka Sc00bz/TobTu), who was on the Password Hashing Competition (PHC) panel. He argues it is better than the alternative ...
- 4,534
2
votes
1
answer
103
views
Best practices on implementing a password manager
I'm a dev new to security and cryptography.
I'm writing a password manager and Time-based OTP combo in dart/flutter to use in multiple devices and platform for fun and use it personally for real. I ...
CommunityBot
- 1
2
votes
1
answer
43
views
Is hashing salt possible even with the password with salt appended to the end?
Should you hash the salt on its own ? Is that possible?
for example being password with salt appended at the end hash(pass || salt) and hash(salt) in a password file?
CommunityBot
- 1
3
votes
1
answer
143
views
Is it possible to sign in to a website using two different passwords using an MD5 hash collision?
I wanna do an experiment. I wanna see if it's possible to sign in to an outdated website that still uses MD5 to store passwords (there are surprisingly still a lot) with two different passwords.
For ...
- 415
8
votes
3
answers
8k
views
Using 32 hexadecimal digits vs equivalent 16-character string password
Assume I'm using a cryptographic algorithm to pseudo-randomly generate a string that is specified to be 16 characters long. The string will be used as a passphrase when encrypting a file.
So, for ...
- 183
3
votes
1
answer
86
views
Can using an unknown, non uniform random salt increase difficulty for password attacks?
I remember reading a previous stack exchange post (unfortunately was unable to find the link, if someone knows the link that would be great!) about a method to make password checking time for the ...
- 134k
5
votes
1
answer
1k
views
Is it true that 7zip doesn't use any salt with its KDF?
This issue claims that 7zip does not use any salt with its key derivation function: https://github.com/magnumripper/JohnTheRipper/issues/1679
If that's true, wouldn't that mean you can crack multiple ...
- 134k
7
votes
1
answer
723
views
Key management in Java + Remembering passwords
I'm new within the area of crypto so I apologise if I am bad at explaining this. So correct me if I've misunderstood anything.
I'm currently developing a Java Fx application that includes the use of a ...
- 415
4
votes
2
answers
211
views
Concatenation of password and TOTP - possible issues
I have come across a two factor login mechanism using Time based OTP (TOTP). TOTP (6 digits) is shown to the user in an app.
There are two ways of logging in.
Method 1:
User inputs the username and ...
CommunityBot
- 1
0
votes
1
answer
54
views
Use name as the initialization vector to encrypt passwords for users
I'm using AES-256-CBC to encrypt password for a set of users, and for each user in the database we gotta generate and store the password in the database. The ...
- 2,542
7
votes
2
answers
14k
views
How long does it take to crack PBKDF2?
How much time will it take to crack PBKDF2 while using a 9 character password? I'm not specifying any specific system or platform. If a brute force attack is made using the best ever super computer ...
- 134k
3
votes
2
answers
147
views
How to calculate probability of cracking a password from entropy?
I am working on a project for my maths assessment where I research the effect of complexity and length on a given password. Currently, I am working on calculating the probability of guessing a ...
- 415
1
vote
2
answers
66
views
Remembering user credentials by double-hashing
I'm developing a desktop application where the users will login with username and password, which is then verified against a database. After the initial login, the current user should be automatically ...
- 1,047
1
vote
4
answers
801
views
How long would it take all of the supercomputers or cloud computing on Earth to bruteforce a significantly long password?
I was arguing with a colleague who thinks that SHA256 (password + 64 character static salt) is "insecure." My argument is that nothing in cryptography is "secure," it's all a ...
- 134k
0
votes
1
answer
47
views
Higher encryption, means less strong password required?
Does higher encryption mean that my password could be shorter? If the time to decrypt is longer, then the chance to bruteforce gets lower too, right?
I've created a KeePass database, and at the ...
- 11.6k
7
votes
1
answer
3k
views
Do I need to use a CSPRNG when creating salts for user accounts?
I'm not sure about the need of using CSPRNG to create salts for each user account.
I found “Cryptographically Secure Pseudo-Random Number Generator in Qt/C++ (Cross platform)” (at StackOverflow) with ...
- 103
1
vote
2
answers
144
views
Hashes to passwords with PBKDF2
If an attacker wants to hack the passwords of $2^{10}$ users. And all of these users generate a password from the space of $2^{50}$ passwords** and each password is hashed with PBKDF2 with $2^{10}$ ...
- 1,047
2
votes
2
answers
219
views
Designing a scheme to store encrypted data on a backend
My goal is to design an encryption scheme for the application so that the backend stores encrypted data and the whole process of encoding and decoding happens on the frontend. And you can be sure that ...
- 123
2
votes
3
answers
744
views
Number of characters in 64-bit and 128-bit password
I have a simple question but I can't seem to find the answer of.
I know that
A 128-bit hash contains 32 characters since each represents a hexadecimal.
Similarly, a 64-bit hash would contain 16 ...
- 415
5
votes
4
answers
295
views
Sending password to server vs. sending SHA
This is an existing website with approx. 100K accounts, and passwords are hashed using bcrypt with a high number of rounds.
The current design that I'm questioning is that we're sending the username ...
- 204
9
votes
2
answers
2k
views
How strong are Bitlocker recovery keys?
This is an example of a bitlocker recovery key;
820042-335825-646573-481530-265253-688132-339900-822810
İs that key actually strong? It does not have any letters, ...
- 134k
0
votes
1
answer
527
views
Is 7-Zip Encryption really secure? [duplicate]
Is 7-Zip really a good encryption tool? I wonder what kind of encryption is used in 7-zip. I see most people using 7-Zip. Just curious about what extent it is safe.
- 415
3
votes
1
answer
659
views
Why does SHA-256 have any to do with scrypt?
I was reading the Wikipedia page for scrypt because I wanted to learn more about it and I came across their pseudocode for the algorithm. What confused me was the following line:
I don't understand ...
- 134k
2
votes
1
answer
74
views
How does biometric authentication add protection to encryption schemes?
I'm wondering since at least 2 offline password management services,Passkeep and Keepass both use biometric authentication in addition to the master password. You need to possess the physical device ...
CommunityBot
- 1
2
votes
1
answer
128
views
Benefit of salt in KDF like Argon2
I don't understand why I need a salt for Argon2 if Argon2 is only needed as a KDF for a password which is then called AES. At the end neither the password nor a password hash is stored. Only the data ...
- 2,741
3
votes
2
answers
651
views
Password Hashing based on Common Passwords
If an attacker has a database of 1,000 users' hashed passwords which are hashed with SHA-256 with a 128-bit salt and all of these users used 10,000 common passwords. How many hashes will the hacker ...
- 223
0
votes
1
answer
54
views
Password space: number of possible password combination
How do I calculate the password space of a randomized linked hybrid pasword of 9 images and 10 numbers(0-9)? User allowed to select 4 password
Images=9
Pin= 0-9
Password selection allowed: 4
Every ...
- 14.9k
4
votes
2
answers
605
views
Password hashing and salting with SHA-256 on $2^{64}$ password space
If a password is randomly chosen from a space of $2^{64}$ passwords and is stored as an SHA-256-bit hash and a 128-bit salt, how many hashes does an attacker need to perform to recover the password in ...
- 121
1
vote
0
answers
72
views
How many hashes to recover a salted password? [closed]
If a password p is selected from a space of 2^64 passwords, and the server stores this as a hash, h = SHA-256(p||s) where s is a random 128-bit salt. How many maximum hashes would an attacker need to ...
- 151
0
votes
0
answers
28
views
how VMK is decrypted?
We know that in bitlocker decryption procedure there is an intermediate key after the hash computing phase which used to encrypt nonce using AES-256 and the result (IV) will be used to decrypt VMK. ...
- 165
3
votes
0
answers
334
views
Algorithm used to generate a BitLocker recovery key
I know exactly how a generated BitLocker recovery key works and I can write a code to brute-force it.
How is the recovery key generated though?
I could think of some answers:
it is generated using an ...
- 90.2k
1
vote
1
answer
234
views
KEY using AES-128, If P is less than 128 bits, padded with 0 and create 128 bits, any problem if average pw length is 6
For communication between the client and the website, use password (P) as the key using AES-128. If P is less than 128 bits, it is padded with 0 to create a 128 bits key. is there any problem with ...
- 46k
0
votes
2
answers
351
views
Password encryption in database
I want to store passwords in a database in a way I can reuse them to authenticate users (symmetrical encryption).
I read some good information here: https://cheatsheetseries.owasp.org/cheatsheets/...
1
vote
2
answers
153
views
Debug bcrypt iterations with a static salt [closed]
I want to debug bcrypt rounds with a static salt using this python lib
...
1
vote
3
answers
425
views
Base64 or hex to attach auth tokens to URL?
I just came across this question, but it does not really answer my main concern that I have regarding password tokens.
To authenticate a client who is not logged in; I generate two random tokens and ...
- 146
0
votes
1
answer
46
views
How easy is it to identifiy the key when knowing a certain number of different AES-256/Fixed Nonce encrypted long-integers
Given some intervals of long integers (64 Bits). I need to generate alphanumeric strings which:
should be used like passwords(known only by few individuals)
must always be the same for the same ...
- 90.2k
1
vote
1
answer
131
views
best encryption algorithm for encrypting a string
I am making a password manager , I am new to cryptography, so , can someone tell me if this can be a good solution?
1- the user inputs the email/password
2- all the payload gets encrypted with aes@...
- 90.2k
0
votes
0
answers
252
views
How do I decrypt an encrypted message with an RSA private key?
I have an encrypted password I must decrypt as part of a challenge. Along with the password came a few UNENCRYPTED RSA private keys
From what I understand, all I need in order to decrypt the password ...
0
votes
2
answers
142
views
Is there a proof that guarantees strength of password?
Is there any proof that guarantees that a password with specified features (eg. with random special characters, combination of numbers & letters, some length etc) is secure? If there is such a ...
- 1,248
3
votes
2
answers
1k
views
How to securely XOR two passphrases in JavaScript?
Is following approach secure?
Planning on using implementation to XOR two passphrases before feeding result to Argon2.
...
- 164
1
vote
0
answers
74
views
Password entropy requirements for online dictionary attacks on OPAQUE?
My understanding is that for PAKE protocols such as OPAQUE (https://eprint.iacr.org/2018/163.pdf), the the adversary has no choice but to just do online attacks on the password. If this is true, I ...
- 71
0
votes
0
answers
29
views
User to be able to log in without stating the user's password scheme possible?
In my database, I have a PBKDF2 hash + salt for every user. My objective is for the user to be able to log in without stating the user's password (in case somebody is logging the network traffic ...
- 99
1
vote
1
answer
1k
views
Can you break PBKDF2 if you know the hash of the password?
I know that PBKDF2 hashes the password a number of times, the result being a key. Can an attacker find the key if they don't know the password, but know the value of the hash of the password?
- 134k
1
vote
1
answer
280
views
How to create a key for AES in a 192 bit key length from a password?
Let's say that I have a password. And it's secure. But it's a 10-character string.
So If I wanted to create an AES key for the 128-bit version of the algorithm I would just hash it using MD5. Or If I ...
- 46k
2
votes
3
answers
106
views
Does encryption of many files shorten the list of possible passwords?
Hopefully this question is not duplicative, nor its answer too elementary.
Suppose I have a file. I encrypt it, using a password. The password presumably stipulates a pattern or relationship between ...
- 1,047
2
votes
2
answers
90
views
Hashing Passwords and Hash Functions
I'm a complete noob. I was reading up on hash functions. So if a bank has its user password's run through a hash function, it'll produce a unique hash for every password right? Thus, even if hackers ...
- 11.2k
0
votes
1
answer
156
views
Using MS Azure to crack password
I heard there is a possibility to perform a brute force attack of an password, I know there is an option to use graphic cards on AWS, but is there a solution for Azure too? Which costs would it take ...
- 2,573
0
votes
0
answers
51
views
Public key cryptography for logins
This is a question sparked purely by curiosity, wanting to understand a little more about cryptography and authentication. Thanks in advance to anybody taking their time to answer.
Instead of salting ...
- 1
1
vote
1
answer
519
views
Is this authentication protocol secure against both eavesdropping and server database disclosure?
Consider the following protocol from the book "Network Security: Private Communication in a Public World" by Kaufman et al.
Alice knows a password. Bob, a server that will authenticate ...
- 140k
1
vote
0
answers
17
views
Is there a known class of techniques about temporary password inaccessibility?
This post asks if a user of a system can restrict their own access in a time-related way.
I am interested in this for freezing and unfreezing cryptocurrency accounts to enforce spending controls, but ...
- 111