Questions tagged [passwords]

Passwords are secret keys which human beings can memorize.

39 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
2 answers
305 views

Concatenation of password and TOTP - possible issues

I have come across a two factor login mechanism using Time based OTP (TOTP). TOTP (6 digits) is shown to the user in an app. There are two ways of logging in. Method 1: User inputs the username and ...
Yash Dhingra's user avatar
4 votes
0 answers
412 views

Can "OPAQUE-over-TLS" authentication be optimized?

So while discussing the issues of password-hashing off-loading in our chat I noticed that it's easy to extend OPAQUE (CFRG draft) to essentially be a better standard password based authentication when ...
SEJPM's user avatar
  • 45.9k
4 votes
0 answers
260 views

Integer factorization based password authentication

After looking at this security issue at DjangoProject, I started to think in a password-based authentication that places the burden of PBKDF2 (or whatever is the hashing function) on the client. So I ...
lvella's user avatar
  • 277
3 votes
0 answers
667 views

Algorithm used to generate a BitLocker recovery key

I know exactly how a generated BitLocker recovery key works and I can write a code to brute-force it. How is the recovery key generated though? I could think of some answers: it is generated using an ...
abbas's user avatar
  • 165
2 votes
0 answers
59 views

What grade of protection does a private key's passphrase provide at best?

Does a passphrase with high entropy provide the same level of security as the private key itself? General scenario: An attacker has access to a private key file that is protected with a passphrase ...
schnatterer's user avatar
1 vote
0 answers
87 views

Password entropy requirements for online dictionary attacks on OPAQUE?

My understanding is that for PAKE protocols such as OPAQUE (https://eprint.iacr.org/2018/163.pdf), the the adversary has no choice but to just do online attacks on the password. If this is true, I ...
Joe's user avatar
  • 73
1 vote
0 answers
18 views

Is there a known class of techniques about temporary password inaccessibility?

This post asks if a user of a system can restrict their own access in a time-related way. I am interested in this for freezing and unfreezing cryptocurrency accounts to enforce spending controls, but ...
Julius H.'s user avatar
  • 111
1 vote
0 answers
172 views

Is it safe to use the same password for both VeraCrypt volume and Windows Login?

I encrypted my entire volume with Veracrypt which prompts on start up and asks for a password, great. Now after every startup is finished or everytime I leave the computer unattended (after a quick ...
Keneff's user avatar
  • 19
1 vote
0 answers
382 views

Hashed password used for encryption and for user authentication at the same time

As I am fairly new to cryptography, I would like to understand how to, in a simple way, implement a system that would achieve the following: the user would have to setup a password, which would then ...
simbr's user avatar
  • 11
1 vote
0 answers
53 views

Is there any “approximate or probabilistic” password authentication method?

I understand that the password-based authorization check procedure requires that you enter a password that is correct, that is, does not allow even a single bit difference. Suddenly I have this ...
Geonhee Cho's user avatar
1 vote
0 answers
112 views

Dragonfly masked DH

I was looking at Dragonfly key exchange protocol RFC 7664, and it seems to make use of masked Diffie-Hellman in the final part. Generating two random numbers less than group order $q$, $m$, and $r$ ...
Manish Adhikari's user avatar
1 vote
0 answers
85 views

Should I use 2x the number of CPU / core for Argon2id parallelism?

I've read that I should use 2x the number of CPU available from some documentation while others suggest using between 1 and the number of CPU. I realize there is no hard answer here but I'm curious ...
Chance's user avatar
  • 111
1 vote
0 answers
103 views

Signal Key Stretching Regarding Their Blog Post

I just read this blog post (Signal - Technology Preview for secure value recovery) by Signal and something is not quite clear to me. In section "Stretching beyond a KDF" they generate a ...
user2403221's user avatar
1 vote
0 answers
575 views

Relationship between "Entropy" and "Security" in crypto functions

There is a lot of confusion between "entropy" and "security" of a cryptographic function. I like to visualize it as the entropy being the water, and the crypto function being a glass. So for ...
cryptonoob400's user avatar
1 vote
0 answers
60 views

Using multiple iterations of Argon2i

Consider Argon2i used as a key derivation function (implemented by the libsodium crypto library) to derive an encryption key from a password. Additionally, when entering the password a second time, ...
Cybran's user avatar
  • 183
1 vote
0 answers
69 views

Password manager that uses a mix of long and short key derivation functions

I was reading "A Convenient Method for Securely Managing Passwords, Halderman et al., 2005". In short, the authors say to do the following: ...
gw653's user avatar
  • 11
1 vote
0 answers
69 views

Does a password that's cracked someone's account increase the chances of cracking someone else's account?

For every find in password that cracks someone's account, does that particular password have a higher probability of cracking someone else's account more than a brute force dictionary choice? How ...
John Palmer's user avatar
1 vote
0 answers
48 views

Registration and log in through public key cryptography?

I read about zero knowledge proofs. Let's say you want to create an account at a website. You choose a password $p$ and from $p$ you derive deterministically a public & private key pair $(e,d)$ ...
wlad's user avatar
  • 1,239
1 vote
0 answers
226 views

Challenge–response authentication which can be done in head?

Say we have door where you have to say a password to pass. If theres someone standing nearby he would hear the password and could also use it. So therefore the doorman gives you a different number ...
user3005031's user avatar
1 vote
0 answers
151 views

Password checking algorithm

I'm trying to reverse engineer a key exchange protocol which is based on the Diffie-Hellman key exchange scheme and faced with the following problem: Let $g$ be the generator, $m$ the modulus. Alice ...
dr.g100k's user avatar
1 vote
1 answer
436 views

deterministic password generator idea

Outside of professional carrier, I often stumble upon a need for a unique password for exp. for local database, game server, or on tons of, not so important, websites. I came up with an idea to write ...
kebabdubaj's user avatar
0 votes
1 answer
126 views

Is there a quantum-safe password-based authentication method that doesn't require giving the server too much data

I've been reading up on different authentication protocols recently while I implemented the sign-in functionality for my website. Many of the suggested methods password-based authentication seem to ...
n-l-i's user avatar
  • 445
0 votes
0 answers
65 views

Can you have a public password file that is still secure?

So I’ve been reading about different ways to store passwords on servers (plain text, encrypted, hashed, hashed + salt, slow hash + salt) and I wanted to find a way where a leak of the stored passwords ...
Beacon of Wierd's user avatar
0 votes
0 answers
43 views

Transmit a password to inheritors

I am looking for a safe and easy way for my inheritors to get a password after my death. That can be the password of a digital vault, a password manager, or anything else. I could write the password ...
mifrey's user avatar
  • 1
0 votes
0 answers
34 views

Academic papers for the pros and cons of password based system and digital signature with challenge and response system

I don't really know what should be the correct title for this and the community can correct it after reading. I was the author of PKDSA (Searchable on github). I have the idea to do it because I feel ...
Hern's user avatar
  • 159
0 votes
0 answers
612 views

How do I decrypt an encrypted message with an RSA private key?

I have an encrypted password I must decrypt as part of a challenge. Along with the password came a few UNENCRYPTED RSA private keys From what I understand, all I need in order to decrypt the password ...
burner67671120's user avatar
0 votes
0 answers
31 views

User to be able to log in without stating the user's password scheme possible?

In my database, I have a PBKDF2 hash + salt for every user. My objective is for the user to be able to log in without stating the user's password (in case somebody is logging the network traffic ...
HelloWorld's user avatar
0 votes
0 answers
53 views

Public key cryptography for logins

This is a question sparked purely by curiosity, wanting to understand a little more about cryptography and authentication. Thanks in advance to anybody taking their time to answer. Instead of salting ...
Remediem's user avatar
0 votes
0 answers
36 views

Is it possible to convert hashed password from one bcypt version to another?

I have passwords hashed using bcypt version \$2a\$ (e.g. "\$2a\$06\$...") and I want to convert them to version \$2b\$ (e.g. "\$2b\$06$..."). Is it possible to do that? If yes, are ...
Akaki Khuntsaria's user avatar
0 votes
0 answers
49 views

Number of combinations with a max. of successively repeated characters

I would like to calculate the possible password combinations for a password that is 60 characters long, has the letters a-f and numbers 0-9. Also no character should repeat successively more than 7 ...
pg00's user avatar
  • 1
0 votes
0 answers
24 views

Is my password database encryption flow secure?

I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it Things I know/think are problematic using base64 digest + getting the first 32 ...
CodingKiwi's user avatar
0 votes
0 answers
67 views

What can be deduced/extracted from this local hash extracted from Windows Machine?

I'm new to cryptography. I've been experimenting with getting Windows hashes to see whether it's possible to reverse engineer. The following hash is what I got from my test laptop. What can you ...
betkorvalic's user avatar
0 votes
0 answers
27 views

Could someone please explain the implementation of public-private key encryption for storing passwords?

As someone new to cryptography,I have a question about how logins work on websites. I understand mathematically how asymmetric encryption works and how https web requests work to securely send ...
ajax2112's user avatar
  • 101
0 votes
0 answers
341 views

BIP32 Extended Key to EC Private and Public Key Pair

We are working on an application in Android using Java. In our project, we used to generate EC key pairs (of size 384 bits) using SpongyCastle - an old Android version of Bouncy Castle. The problem ...
Marco7757's user avatar
  • 101
0 votes
0 answers
111 views

Digital Signature Password verification

I currently have this TOFU protocol: First connection: Client generates salt and inputs a password Client saves salt Client hashes password with argon2 and salt Client generates Ed25519 keys Client ...
OughtToPrevail's user avatar
0 votes
0 answers
199 views

Time-based decryption service

i am thinking about building a public crypto service, yet at the same time, I am still quite new to crypto and therefore prone to snake-oil inventions I guess. My plan is to build a website which ...
Glaze's user avatar
  • 9
0 votes
0 answers
55 views

Using a straight password for encryption and authentication

Assume we have a password like 3buNCh_7kaRmencrEst3. Now suppose we have two parties who know this password. We a have communication scheme that uses the password ...
Melab's user avatar
  • 3,645
0 votes
0 answers
254 views

Encrypt/Decrypt cloud passwords with master password

I know it's generally bad to store password in the clouds, and that I should be using salted-hashed password only. I'm making an application that will authenticate a user (with salted-hash), and then ...
Zorgatone's user avatar
  • 137
0 votes
1 answer
302 views

Hardware, Handheld Password Manager

I am currently working on a hardware project that will utilize the native USB and keyboard emulation capabilities of the Teensy device. Essentially, the user will store an encrypted password database ...
Goodies's user avatar
  • 145