Questions tagged [passwords]
Passwords are secret keys which human beings can memorize.
505
questions
1
vote
2
answers
688
views
Comparing different hashes to confirm they came from the same string
Is there any safe hashing algorithm that returns a different hash each time (like bcrypt) but has the possibility to compare 2 different hashes and determine that they were hashed from the same ...
- 11
1
vote
1
answer
1k
views
How difficult is it to crack sha256(sha256(pin)) with a 6 digit pin and no salt?
My friend forgot the password to his electrum wallet but knows that it's a 6 digit pin. I looked into it and from what I can find electrum uses the sha256(sha256(pin)) to generate the key used to ...
- 31
0
votes
5
answers
49k
views
Is there a practical way to crack an AES encryption password?
I heard that the fastest method to crack an AES-128 encryption, or and AES-256 encryption is by brute force, which can take billions of years. But I can't help thinking there's got to be a faster way. ...
- 147
0
votes
1
answer
1k
views
How does GRC password generator get 512 bit of secret data?
I'm trying to understand how GRC password generator can get 512 bit of secret data while encrypting 128-bit of data.
The generator address is located here: https://www.grc.com/passwords.htm
See the "...
- 199
5
votes
2
answers
2k
views
Security of non-standard use for AES-256-CTR?
I have a string secret that I would like to encrypt for storage in a Yubikey's second slot. These slots can be configured to store up to 38 characters that are later "typed" by the USB device acting ...
- 51
0
votes
1
answer
46
views
How to test massives amount of links? [closed]
Ok, I have a wordlist of many many links (of the same site with a bit of difference in URL).
I'm certain that the majority of then will return the same result, a error page. But one will return the "...
-1
votes
1
answer
1k
views
How secure is RSA for authentication?
I'm building a web-based password manager system and would ideally not send sufficient information to the servers to decode the raw text passwords of users. The plan is to encrypt the raw text ...
- 3
0
votes
1
answer
692
views
Any point to AES on password with hardcoded key?
I'm inheriting a project that stores a used password in a config file, which is generated by the user giving their password in plain text, and the project giving back a key generated through .NET's ...
- 101
-2
votes
1
answer
995
views
Would Hashing A Password In Sha512 Using JavaScript Be Secure?
I've created a competition for a few friends of mine that wanted to learn the basics of penetration testing. In said competition, there is one section in which there's a log file you need to check out ...
1
vote
2
answers
381
views
KDF-based password manager
I want to make a password manager that from a single master password generates passwords for my services. For that I thought that HKDF suits my needs, as it is able to generate multiple keys from a ...
- 13
8
votes
3
answers
8k
views
Using 32 hexadecimal digits vs equivalent 16-character string password
Assume I'm using a cryptographic algorithm to pseudo-randomly generate a string that is specified to be 16 characters long. The string will be used as a passphrase when encrypting a file.
So, for ...
- 183
2
votes
1
answer
2k
views
Simple secret key encryption with PyNaCl [closed]
I am playing around with PyNaCl to get a bit into cryptography atm.
Now I wrote two scripts to encrypt a file with a secret key and then decrypt it again using that key. The encryption part works ...
- 31
0
votes
1
answer
195
views
Issues with Seeding Random Number Generator Using Password
I am looking into zero-knowledge proof-based security. I noticed that a server never needs to be sent the user's password to authenticate them - the password can be used to generate another value that ...
- 11
3
votes
2
answers
2k
views
About salted passwords
In most applications, all passwords are salted independently. In terms of security (e.g. attack complexity), what are the consequences of the following differents approaches:
All passwords are salted ...
- 2,817
3
votes
1
answer
233
views
Is there a term for "bootstrapping" encryption by storing an encrypted key?
Say you want to encrypt a large file, perhaps a backup of a database. Encrypting the file will naturally take some time, due to the amount of data.
Now, if at any point you want to change the ...
- 31
0
votes
2
answers
520
views
Passphrases, Dictionary attacks and 'bit shift'
How much better would a passphrase be if you swapped the first letters of each word with a shift to the left:
"correct battery horse staple" becomes "borrect hattery sorse ctaple"
This would be ...
0
votes
1
answer
521
views
Can a Password be Derived from a AES key?
This thought randomly popped into my head and I have not been able to find a clear, defined answer for it. Given an AES key, lets say an AES-256 key which is derived from a user password, is there any ...
- 141
4
votes
2
answers
2k
views
Can pbkdf2 be used with a fixed salt to give a deterministic slow hash?
I need a password hashing function that is deterministic. Correlation attacks are not a concern. The same password must produce the same hash. I just want to protect the password against dictionary ...
- 2,369
1
vote
2
answers
259
views
Can multiple hashing weaken the password?
Problem. I want a longer key out of password than my hashing function provide.
Idea. I want to hash password multiple times rotating chars one position each time and use composite key.
Question. ...
- 67
-2
votes
1
answer
1k
views
How important is length and complexity of personal password for AES-256 encryption?
I want ask you how important is to have complicated personal password for AES-256 crypto?
For example if I use these two "types" of passwords:
pass123
...
- 361
5
votes
3
answers
240
views
-1
votes
1
answer
2k
views
How to decrypt a string given as part of a game/prank? [closed]
I have been given an obviously encoded string, that looks similar to this:
...
- 117
1
vote
1
answer
191
views
Understanding Password Complexity
I’m trying to understand how a program checks for passwords and how fast it iterates through a loop.
I think I understand how to calculate the minimum required strength for my password.
Estimate ...
- 119
1
vote
2
answers
234
views
Total password count, given length and pool size
First, if my password is exactly 8 characters long, derived from a pool of 95 characters, then is the total amount of passwords I can create simply $95^8$ ...
- 404
0
votes
1
answer
1k
views
Password protected Excel files
I need to send an Excel file to someone, normally I would use encrypted e-mail, however, this is not an option with this individual. What is the minimum length password I can apply to this file to get ...
- 125
0
votes
1
answer
3k
views
extract password hashed in scrypt using hash and salt [closed]
I have the hashed password and its salt. It is encrypted using SCRYPT by firebase.
How can I extract the plain text password from these two?
Or alternatively, how can I re-encrypt or convert them ...
- 101
1
vote
2
answers
2k
views
UNIX password scheme and encryption function
Recent versions of Unix store encrypted passwords in a file that is not publicly accessible. Such files are called shadow password files.
In the UNIX password scheme, if only the operating system and ...
- 121
0
votes
1
answer
592
views
PBEWithHmacSHA512AndAES_128 and AES Modes like GCM [closed]
I've asked this question on stackoverflow
And I think one gentleman has already answered the first part of question
a) In my code i am keeping IV and salt with ciphertext. I wanted to use ...
-1
votes
1
answer
114
views
New Passwording? [closed]
I just want to note before you continue reading--this does not specifically apply to hashes or the key to encrypted messages. However, I am initially thinking about password/key solving/remembering by ...
- 1
16
votes
4
answers
5k
views
Is using a broken SHA-1 for password hashing secure?
Recently the hashing collision issue of SHA-1 was discovered. Identical hash values for 2 separate PDF files were generated. Does that make SHA-1 any unsafe for using it only for password hashing?. ...
- 263
-1
votes
2
answers
69
views
Is there some encryption scheme which is getting increase "noise" and then can't be indecipherable at last?
There's some function f() which has some "error", so "error" grows when decryption is failed every time and then finally it won't be able to decrypt. But, the "error" will be initialized when its ...
- 101
0
votes
1
answer
183
views
Password-Managers: what is the IND-CDBA attack logic?
In the work of Paolo Gasti and Kasper B. Rasmussen On The Security of Password Manager Database Formats, they describe two attack forms: IND-CDBA and MAL-CDBA.
While I understand the MAL-CDBA attack ...
- 41
6
votes
1
answer
2k
views
Choice between AES-128 and AES-256 for password protection in MS Office
Why are we still using the default of AES-128 when password protecting a Microsoft Word document. My answer is and always has been - because its good enough and MS don't recommend changing to AES-256. ...
- 61
3
votes
1
answer
353
views
Stateless user-generated one-time passwords
I've been working on my course project lately and got stuck with the problem which I reduced to the following abstract protocol:
Alice generates an ID key and gives it to Bob.
Bob generates some ...
- 156
4
votes
1
answer
467
views
Can the TLS 1.3 PSK-DHE handshake be turned into a PAKE?
Recently, we had the question whether there's a PAKE that uses more standard, higher-level primitives than what SRP offers.
Now this made me think and ask myself: TLS does have a PSK mode, can't we ...
- 45.5k
4
votes
2
answers
238
views
Is there a perpetual 2-factor-authentication scheme that allows temporary password generation?
Recall that current forms of two-factor authentication (2FA) rely on:
Something you know, i.e. your password
Something you have, i.e. your one-time password (OTP) generator on a trusted device
The ...
- 1,319
1
vote
0
answers
52
views
scientific research about what is more secure: biometric authentication vs regular [closed]
I've already posted this question on Stackoverflow, but got downvoted and told to post here instead. So here we go.
I am searching for citeable sources / papers that research about what is more ...
- 111
7
votes
1
answer
723
views
Key management in Java + Remembering passwords
I'm new within the area of crypto so I apologise if I am bad at explaining this. So correct me if I've misunderstood anything.
I'm currently developing a Java Fx application that includes the use of a ...
1
vote
0
answers
563
views
Relationship between "Entropy" and "Security" in crypto functions
There is a lot of confusion between "entropy" and "security" of a cryptographic function.
I like to visualize it as the entropy being the water, and the crypto function being a glass.
So for ...
- 533
20
votes
8
answers
16k
views
Password cracking: What if attacker is lucky? [closed]
We have always measured password or private key strength by the amount of entropy it contains, but what if the attacker who cracks it is lucky.
Consider the following simple scenario, we have 1 bit [...
- 533
4
votes
1
answer
563
views
How can you extract individual characters of an encrypted string such as a password?
Many banks and other systems have some sort of a "select the Nth, Nth, and Nth characters of your password" system.
I don't believe they are going to be storing in plain text, nor would it make much ...
- 141
1
vote
2
answers
1k
views
How to calculate the needed encryptions in salted passwords?
Consider if a 16-bit salt is used, and it is uniformly applied over a very large password file (200,000 entries). An attacker wants to see if one particular password (say, "bubba") is used by any of ...
- 111
1
vote
2
answers
483
views
Generating password from high entropy file
Assuming
We want to generate a password of 32 bytes, using a keyfile as source but not using it directly but via an intermediate step;
So:
We have a file of 100MB file with high entropy
We ask the ...
- 11
8
votes
1
answer
4k
views
How to configure Argon2d for commodity hardware?
You may already have heard it: KeePass v2.35 has support for a new database format (KDBX4) which allows for the use of Argon2 (more precisely: Argon2d) as the password-based key derivation function (...
- 45.5k
17
votes
4
answers
4k
views
How is the quality of a password calculated and what does it mean?
While using Keepass and using it to generate random passwords, I always have noticed the "quality" section but truthfully have never known what it actually means.
So my questions are;
How much ...
- 273
0
votes
0
answers
552
views
How to use private key with Hash algorithims for storing passwords [duplicate]
UPDATE
Found an answer here: Recommended way of adding a pepper/secret key to password before hashing?
After reading https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords ...
Alzoid
1
vote
1
answer
289
views
securing the keystore
When generating a public-private key pair you have the option to secure the keystore with a password.
where is that password stored, is it a hashed version that is stored and if that is so which ...
- 155
9
votes
3
answers
2k
views
Cryptocurrency serving as hash breaking?
There are many people mining for Bitcoin right this second.[Citation needed]
Bitcoin's proof-of-work mining system is based on a hash function (SHA-256, I believe), and there are ASICs built ...
- 213
0
votes
2
answers
407
views
What is the probability of the first half of a hash output being identical to the first half of another hash output?
Let's say for example that I encrypt a password with some hash function and receive a 256-bit hash value in return. What are the chances that the first 128-bits (half) of this value are identical to ...
- 3
1
vote
3
answers
240
views
Require x of y possible passwords to decrypt
Is there a way to set up encryption so that a certian number (x) out of a total (y) number of users/passwords are required to do the decryption?
Background: This is mostly a thought experiment, and ...
- 13