Questions tagged [passwords]
Passwords are secret keys which human beings can memorize.
36
questions with no upvoted or accepted answers
4
votes
2
answers
210
views
Concatenation of password and TOTP - possible issues
I have come across a two factor login mechanism using Time based OTP (TOTP). TOTP (6 digits) is shown to the user in an app.
There are two ways of logging in.
Method 1:
User inputs the username and ...
- 41
4
votes
0
answers
400
views
Can "OPAQUE-over-TLS" authentication be optimized?
So while discussing the issues of password-hashing off-loading in our chat I noticed that it's easy to extend OPAQUE (CFRG draft) to essentially be a better standard password based authentication when ...
- 45.5k
4
votes
0
answers
257
views
Integer factorization based password authentication
After looking at this security issue at DjangoProject, I started to think in a password-based authentication that places the burden of PBKDF2 (or whatever is the hashing function) on the client. So I ...
- 277
3
votes
0
answers
330
views
Algorithm used to generate a BitLocker recovery key
I know exactly how a generated BitLocker recovery key works and I can write a code to brute-force it.
How is the recovery key generated though?
I could think of some answers:
it is generated using an ...
- 165
2
votes
0
answers
56
views
What grade of protection does a private key's passphrase provide at best?
Does a passphrase with high entropy provide the same level of security as the private key itself?
General scenario: An attacker has access to a private key file that is protected with a passphrase ...
- 121
1
vote
0
answers
74
views
Password entropy requirements for online dictionary attacks on OPAQUE?
My understanding is that for PAKE protocols such as OPAQUE (https://eprint.iacr.org/2018/163.pdf), the the adversary has no choice but to just do online attacks on the password. If this is true, I ...
- 71
1
vote
0
answers
17
views
Is there a known class of techniques about temporary password inaccessibility?
This post asks if a user of a system can restrict their own access in a time-related way.
I am interested in this for freezing and unfreezing cryptocurrency accounts to enforce spending controls, but ...
- 111
1
vote
0
answers
131
views
Is it safe to use the same password for both VeraCrypt volume and Windows Login?
I encrypted my entire volume with Veracrypt which prompts on start up and asks for a password, great.
Now after every startup is finished or everytime I leave the computer unattended (after a quick ...
- 19
1
vote
0
answers
53
views
Is there any “approximate or probabilistic” password authentication method?
I understand that the password-based authorization check procedure requires that you enter a password that is correct, that is, does not allow even a single bit difference.
Suddenly I have this ...
- 11
1
vote
0
answers
100
views
Dragonfly masked DH
I was looking at Dragonfly key exchange protocol RFC 7664, and it seems to make use of masked Diffie-Hellman in the final part. Generating two random numbers less than group order $q$, $m$, and $r$ ...
- 561
1
vote
0
answers
72
views
Should I use 2x the number of CPU / core for Argon2id parallelism?
I've read that I should use 2x the number of CPU available from some documentation while others suggest using between 1 and the number of CPU.
I realize there is no hard answer here but I'm curious ...
- 111
1
vote
0
answers
100
views
Signal Key Stretching Regarding Their Blog Post
I just read this blog post (Signal - Technology Preview for secure value recovery) by Signal and something is not quite clear to me. In section "Stretching beyond a KDF" they generate a ...
- 111
1
vote
0
answers
563
views
Relationship between "Entropy" and "Security" in crypto functions
There is a lot of confusion between "entropy" and "security" of a cryptographic function.
I like to visualize it as the entropy being the water, and the crypto function being a glass.
So for ...
- 533
1
vote
0
answers
58
views
Using multiple iterations of Argon2i
Consider Argon2i used as a key derivation function (implemented by the libsodium crypto library) to derive an encryption key from a password.
Additionally, when entering the password a second time, ...
- 183
1
vote
0
answers
66
views
Password manager that uses a mix of long and short key derivation functions
I was reading "A Convenient Method for Securely Managing Passwords, Halderman et al., 2005". In short, the authors say to do the following:
...
- 11
1
vote
0
answers
69
views
Does a password that's cracked someone's account increase the chances of cracking someone else's account?
For every find in password that cracks someone's account, does that particular password have a higher probability of cracking someone else's account more than a brute force dictionary choice?
How ...
- 11
1
vote
0
answers
48
views
Registration and log in through public key cryptography?
I read about zero knowledge proofs.
Let's say you want to create an account at a website. You choose a password $p$ and from $p$ you derive deterministically a public & private key pair $(e,d)$ ...
- 1,219
1
vote
0
answers
216
views
Challenge–response authentication which can be done in head?
Say we have door where you have to say a password to pass. If theres someone standing nearby he would hear the password and could also use it. So therefore the doorman gives you a different number ...
- 11
1
vote
0
answers
151
views
Password checking algorithm
I'm trying to reverse engineer a key exchange protocol which is based on the Diffie-Hellman key exchange scheme and faced with the following problem:
Let $g$ be the generator, $m$ the modulus.
Alice ...
- 11
1
vote
1
answer
224
views
deterministic password generator idea
Outside of professional carrier, I often stumble upon a need for a unique password for exp. for local database, game server, or on tons of, not so important, websites.
I came up with an idea to write ...
- 11
0
votes
0
answers
27
views
how VMK is decrypted?
We know that in bitlocker decryption procedure there is an intermediate key after the hash computing phase which used to encrypt nonce using AES-256 and the result (IV) will be used to decrypt VMK. ...
- 165
0
votes
0
answers
252
views
How do I decrypt an encrypted message with an RSA private key?
I have an encrypted password I must decrypt as part of a challenge. Along with the password came a few UNENCRYPTED RSA private keys
From what I understand, all I need in order to decrypt the password ...
0
votes
0
answers
29
views
User to be able to log in without stating the user's password scheme possible?
In my database, I have a PBKDF2 hash + salt for every user. My objective is for the user to be able to log in without stating the user's password (in case somebody is logging the network traffic ...
- 99
0
votes
0
answers
51
views
Public key cryptography for logins
This is a question sparked purely by curiosity, wanting to understand a little more about cryptography and authentication. Thanks in advance to anybody taking their time to answer.
Instead of salting ...
- 1
0
votes
0
answers
203
views
Hashed password used for encryption and for user authentication at the same time
As I am fairly new to cryptography, I would like to understand how to, in a simple way, implement a system that would achieve the following: the user would have to setup a password, which would then ...
- 1
0
votes
0
answers
33
views
Is it possible to convert hashed password from one bcypt version to another?
I have passwords hashed using bcypt version \$2a\$ (e.g. "\$2a\$06\$...") and I want to convert them to version \$2b\$ (e.g. "\$2b\$06$..."). Is it possible to do that? If yes, are ...
0
votes
0
answers
44
views
Number of combinations with a max. of successively repeated characters
I would like to calculate the possible password combinations for a password that is 60 characters long, has the letters a-f and numbers 0-9. Also no character should repeat successively more than 7 ...
- 1
0
votes
0
answers
23
views
Is my password database encryption flow secure?
I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it
Things I know/think are problematic
using base64 digest + getting the first 32 ...
- 101
0
votes
0
answers
56
views
What can be deduced/extracted from this local hash extracted from Windows Machine?
I'm new to cryptography. I've been experimenting with getting Windows hashes to see whether it's possible to reverse engineer. The following hash is what I got from my test laptop. What can you ...
0
votes
0
answers
27
views
Could someone please explain the implementation of public-private key encryption for storing passwords?
As someone new to cryptography,I have a question about how logins work on websites. I understand mathematically how asymmetric encryption works and how https web requests work to securely send ...
- 101
0
votes
0
answers
313
views
BIP32 Extended Key to EC Private and Public Key Pair
We are working on an application in Android using Java. In our project, we used to generate EC key pairs (of size 384 bits) using SpongyCastle - an old Android version of Bouncy Castle.
The problem ...
- 101
0
votes
0
answers
108
views
Digital Signature Password verification
I currently have this TOFU protocol:
First connection:
Client generates salt and inputs a password
Client saves salt
Client hashes password with argon2 and salt
Client generates Ed25519 keys
Client ...
- 314
0
votes
0
answers
163
views
Time-based decryption service
i am thinking about building a public crypto service, yet at the same time, I am still quite new to crypto and therefore prone to snake-oil inventions I guess.
My plan is to build a website which ...
- 9
0
votes
0
answers
55
views
Using a straight password for encryption and authentication
Assume we have a password like 3buNCh_7kaRmencrEst3. Now suppose we have two parties who know this password. We a have communication scheme that uses the password ...
- 3,487
0
votes
0
answers
251
views
Encrypt/Decrypt cloud passwords with master password
I know it's generally bad to store password in the clouds, and that I should be using salted-hashed password only.
I'm making an application that will authenticate a user (with salted-hash), and then ...
- 137
0
votes
1
answer
294
views
Hardware, Handheld Password Manager
I am currently working on a hardware project that will utilize the native USB and keyboard emulation capabilities of the Teensy device. Essentially, the user will store an encrypted password database ...
- 145