Questions tagged [passwords]

Passwords are secret keys which human beings can memorize.

Filter by
Sorted by
Tagged with
60 votes
2 answers
20k views

What makes a hash function good for password hashing?

Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the ...
You's user avatar
  • 703
46 votes
5 answers
10k views

Is there a secure cryptosystem that can be performed mentally?

I, myself, do not plan on getting into a situation where I would be unable to use a computer in order to communicate securely. However, I can think of many practical situations in which mental ...
John Gietzen's user avatar
  • 1,505
148 votes
5 answers
130k views

What is a cryptographic "salt"?

I'm a beginner to cryptography and looking to understand in very simple terms what a cryptographic "salt" is, when I might need to use it, and why I should or should not use it. Can I get a ...
Bhavik Ambani's user avatar
117 votes
4 answers
79k views

How should I calculate the entropy of a password?

If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
this.josh's user avatar
  • 1,977
5 votes
2 answers
2k views

Is using 7-8 random words from all words of a language as password a good idea?

The Bitcoin Bip-39 dictionary has 2048 words. And a random 24 of them are pretty secure together. What if the source is bigger (all words in the language) but there are only about 7-8 words? These ...
Anonymous's user avatar
25 votes
3 answers
7k views

Should you change salt when changing password?

Assume a password storage scheme using a computationally-expensive hash algorithm and a CSPRNG salt. User ID, salt, and hash value are stored in a table; if the table is compromised, all three ...
Bob Brown's user avatar
  • 353
13 votes
3 answers
7k views

Is there a way to make RC4 (ARCFOUR) secure, or is it completely broken?

I need a method to authenticate a process with another in order to establish interprocess communication between them, to prevent malicious processes from trying to hook onto the system. Currently I ...
Kevin Jin's user avatar
  • 241
23 votes
3 answers
3k views

Is using slow password hashing on the client side easier attackable than on the server side?

As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
Paŭlo Ebermann's user avatar
21 votes
6 answers
2k views

Why does PBKDF2 xor the iterations of the hash function together?

The definition of PBKDF2 states that I obtain a derived key (1) by calling a pseudorandom function a bunch of times recursively: $U_1 = PRF(password, salt)$ $U_2 = PRF(password, U_1)$ … $U_n = PRF(...
Cameron Skinner's user avatar
14 votes
2 answers
4k views

Use of salt to hash a password

In a few implementations of hashed passwords, I have seen that the length of the random salt is chosen to be, say, 10 or "some constant". Is there any specific reason why the salt is chosen to have a ...
hrishikeshp19's user avatar
10 votes
1 answer
3k views

Recommended way of adding a pepper/secret key to password before hashing?

There have been several questions regarding password hashing here and on Security.SE. A "pepper" is sometimes mentioned – an application-specific secret key. The canonical answer on password hashing ...
user avatar
6 votes
3 answers
471 views

Bounding security of password authentication given entropy

An adversary Craig tries to log-in as Alice on a system that will only accept the right password, leaks (only) if an attempt succeeds, and allows many attempts. Alice's password choice is modeled as ...
fgrieu's user avatar
  • 141k
35 votes
8 answers
13k views

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

I'm not even sure if they are serious, but I've heard many times that some people refuse to not only trust their computer to generate a random string (which is understandable) but also don't trust ...
K. B.'s user avatar
  • 383
30 votes
3 answers
24k views

What is the recommended number of iterations for Argon2?

I've recompiled my operating system ("LionBSD" based on FreeBSD) to use Argon2i as the default password hashing algorithm in crypt/libcrypt. I'm wondering what the recommended number of iterations ...
fizk's user avatar
  • 435
25 votes
3 answers
967 views

What differentiates a password hash from a cryptographic hash besides speed?

I understand that password hashes like bcrypt have the principal property of taking a long time to run, but I'm wondering what if anything about password hashes make them superior to merely running a ...
Steven's user avatar
  • 353
15 votes
5 answers
5k views

How can rainbow tables be used for a dictionary attack?

I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length. The maximum length I can enforce is 14 characters. ...
Mitchell Kaplan's user avatar
14 votes
2 answers
2k views

Do I have to have a different salt for each password?

Should I use a different salt for each password? In my system, there are no user names, only passwords. When a user logins in, he types in one or more passwords and the server compares the results ...
Eyal's user avatar
  • 405
11 votes
1 answer
31k views

Encryption algorithm used in WPA/WPA2

I want to know how EXACTLY the WPA password gets encrypted I have been searching through and I was able to catch: The actual password is converted to some hash Salting is applied to the hash The ...
OverCoder's user avatar
  • 273
10 votes
1 answer
3k views

What are the security implications of multiple hashing?

There are plenty of questions on this site about hashing passwords. However, none of them quite cover this topic. One of those links covers using multiple different hash algorithms; one covers general ...
ArtOfCode's user avatar
  • 203
7 votes
4 answers
2k views

Webapp password storage: Salting a hash vs multiple hashes?

For security's sake, of course it's blasphemous to store passwords in plain-text; using a hash function and then doing a re-hash and comparison is considered much better. But, if bad guys steal your ...
SeanKilleen's user avatar
4 votes
1 answer
1k views

Is password hashing post-quantum secure?

Current computers cannot break reasonably strong hashed passwords, for example 14 CSPRNG-generated alphanumeric characters ($\approx$80 bits of entropy). Grover's algorithm applies to hash functions ...
Luc's user avatar
  • 1,508
2 votes
1 answer
8k views

How to calculate the entropy of passwords? [duplicate]

Here is a cartoon about password entropy. http://xkcd.com/936/ I dont quite understand how the entropy is calculated in the cartoon assuming they are calculate correctly. But in general, I dont have ...
drdot's user avatar
  • 359
1 vote
2 answers
3k views

Deriving HMAC key and cipher key from passphrase? [duplicate]

I'm encrypting a file with AES-256 in CBC mode. I needed to add an HMAC for authentication and validation of the file contents and passphrase, so I used a SHA-256 HMAC over chunks of my file ...
Naftuli Kay's user avatar
29 votes
3 answers
3k views

Is this password migration strategy secure?

I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
Major Major's user avatar
17 votes
2 answers
2k views

Is bcrypt better than GnuPG's iterated+salted hashing method?

GnuPG has slow hash built-in in form of iterated+salted S2K. Does it have disadvantages in comparison with bcrypt or scrypt? Is GnuPG's slow hash method easily automated in GPUs?
Andrei Botalov's user avatar
9 votes
1 answer
4k views

How to configure Argon2d for commodity hardware?

You may already have heard it: KeePass v2.35 has support for a new database format (KDBX4) which allows for the use of Argon2 (more precisely: Argon2d) as the password-based key derivation function (...
SEJPM's user avatar
  • 46k
9 votes
1 answer
1k views

Why does SRP-6a use k = H(N, g) instead of the k = 3 in SRP-6?

I've been reading up on the Secure Remote Pasword protocol (SRP). There are a couple different versions of the protocol (the original published version being designated SRP-3, with two subsequent ...
Robert I. Jr.'s user avatar
8 votes
1 answer
3k views

Does salt size affect password hash security?

I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of ...
Pascal Bergeron's user avatar
8 votes
1 answer
1k views

What's the reason for applying the hash twice when hashing with salt?

One of the typical approaches to computing a salted hash is this: hash(salt+hash(secret)) where hash is something like SHA-256 hash function - taking any size ...
sharptooth's user avatar
6 votes
1 answer
3k views

What happens to the entropy of a password when you hash it?

For example, if the entropy of a password is 30 bits, what is the entropy of the password when you hash it with MD5?
null's user avatar
  • 255
5 votes
1 answer
405 views

Why are there $ signs in my passwd file?

I am trying to get access to my eReader and I managed to get the passwd file. ...
nana's user avatar
  • 153
5 votes
2 answers
1k views

How did LinkedIn "salt" all their passwords?

First, just to make sure I understand "salting" correctly: You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
user541686's user avatar
  • 1,349
4 votes
1 answer
462 views

Which version(s) of SRP are in ISO/IEC 11770-4:2006?

I am on the impression that SRP emerges as the least uncommon and best analyzed protocol for authentication and key agreement based on a short password. This states that SRP is part of IEC 11770-4, ...
fgrieu's user avatar
  • 141k
2 votes
2 answers
236 views

How many passwords are possible in this scenario?

A password string consists of one or more of the 26 characters A..Z and can be of any length from $1$ to $8$ characters. How many password are possible in this scenario? As my calculation, it should ...
uma's user avatar
  • 231
2 votes
2 answers
3k views

Just how insecure are VeraCrypt containers encrypted with short passwords?

When I create a VeraCrypt file container using the GUI, it displays a warning whenever I type in a password under a given number of characters. I was wondering just how insecure, in practical terms, ...
chancellorofpaphos's user avatar
0 votes
2 answers
259 views

Can an attacker exploit the nonuniform distribution of letters in a diceware password to improve a brute force search?

I use some diceware pass phrases in some places but I have one question that I can't find the answer to. Let's say I roll the dice and get $N$ words with a total of $M$ letters and that I don't put ...
evading's user avatar
  • 103
20 votes
8 answers
16k views

Password cracking: What if attacker is lucky? [closed]

We have always measured password or private key strength by the amount of entropy it contains, but what if the attacker who cracks it is lucky. Consider the following simple scenario, we have 1 bit [...
cryptonoob400's user avatar
16 votes
3 answers
8k views

Do I have to recompute all hashes if I change the work factor in bcrypt?

The well-known article about why we should use bcrypt for hashing passwords mentions the work factor - some parameter to the algorithm that determines how long one hashing should be in terms of number ...
sharptooth's user avatar
15 votes
2 answers
9k views

Can a salt for a password hash be public?

From my understanding, salts in password hashes are used to prevent the precomputation of plaintext→hash values (rainbow tables). I know from different threads that it is unnecessary to keep the salt ...
Chris's user avatar
  • 325
13 votes
3 answers
2k views

Password entropy much lower than entropy of encryption keys. Why is this acceptable?

When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner. When talking passwords however, the standard these days is ...
Minaj's user avatar
  • 1,080
12 votes
13 answers
2k views

Cryptography elements needed for a story

Note: following Maarten Bodewes's answer, I edited this post to make it clearer. I'm writing something partly driven by the need to crack a few encrypted files. This is what needs to happen in the ...
Nicola's user avatar
  • 369
11 votes
4 answers
3k views

What is the best-practice for encrypting small files?

I would like to know how to store a sensitive file; a credential of sorts. I want to password-protect it, obviously. It would be appropriate - in my application - to prompt the user for the password ...
Will's user avatar
  • 412
9 votes
4 answers
636 views

Using hashes as passwords

I have thought of a system for generating passwords which works as follows: Take the following items: A password, such as williamwallace. A secret 1000 digit ...
daviewales's user avatar
9 votes
3 answers
2k views

Cryptocurrency serving as hash breaking?

There are many people mining for Bitcoin right this second.[Citation needed] Bitcoin's proof-of-work mining system is based on a hash function (SHA-256, I believe), and there are ASICs built ...
Sarah's user avatar
  • 213
9 votes
2 answers
2k views

What are the pros and cons of deterministic site-specific password generation from a master pass?

I've been reading up a bit on deterministic password generators. All the ones I can find basically do something like this: Pick a master username and a master passphrase. The username could be your ...
Jennifer Crowley's user avatar
8 votes
1 answer
308 views

How to generate a key using any $m$ passwords out of total $n$?

My application requires an AES-256 key K for some secure operation. In order to avoid saving this key in application, I have implemented following scheme: There ...
Hemant's user avatar
  • 203
8 votes
2 answers
1k views

Hash decrypts key, key decrypts cipher... why?

I noticed recently that a couple of pieces of encryption software (TrueCrypt being one of them) don't directly use a hash of the password as the key for the block cipher. Instead, they generate a ...
Polynomial's user avatar
  • 3,527
8 votes
1 answer
4k views

gpg --gen-random quality level: is higher "better"?

The GNU Privacy Guard manual pages have this to say about using the gpg --gen-random 0|1|2 count command: Emit count random bytes of the given quality level 0, 1 ...
camercu's user avatar
  • 333
8 votes
3 answers
1k views

Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
Jason's user avatar
  • 373
7 votes
2 answers
5k views

Maximum password length in PBKDF2

Haven't found any clear cut answer in Google so its up to you guys: DK = PBKDF2(PRF, Password, Salt, c, dkLen) Here, what is the upper limit of password length? ...
Giliweed's user avatar
  • 597