Questions tagged [passwords]
Passwords are secret keys which human beings can memorize.
515
questions
8
votes
4
answers
6k
views
Password length versus hash length?
If a system hashes passwords with a 256-bit long hash, are passwords (which are not necessarily alphanumeric, can be any value per byte (0-255)) longer than 32 bytes useless under the context in which ...
- 81
0
votes
1
answer
105
views
How do I control an access code safely?
Upon registration an user has to specify an access code of five digits. This access code is also used as a password for the encryption and decryption of certain strings.
The user types in "12345" (...
- 227
1
vote
1
answer
333
views
Value of S and r in Fiat-Shamir Protocol
In the book Cryptography and Network Security by Forouzan,in chapter 14, Fiat-Shamir protocol, its mentioned that two large prime numbers p and q are chosen and kept secret. However n=p*q is made ...
user3424954
1
vote
1
answer
98
views
Errata for NIST SP 800-63
I'm looking through the latest version of NIST SP 800-63, and there is a table (Table A.1) in the Appendix that supposed give the "entropy" of a password for a 94 character alphabet for various ...
- 219
1
vote
1
answer
770
views
What is the proper way to generate a fixed length key from a variable length password?
The password is entered by the user and the key is processed locally. Neither the password nor the key will be stored, only used and forgotten (but hopefully not by the user). Is SHA256 by itself ...
- 2,369
1
vote
1
answer
2k
views
Creating a random password based off of a prime number
So I am making an application that basically creates strings that must be encrypted before they are stored on a user's device. If the user blindly starts running the application without creating a ...
- 113
1
vote
2
answers
552
views
Removing "security by obscurity" from port knocking
Every article about port knocking, for instance https://wiki.archlinux.org/index.php/Port_Knocking , declares this method as security by obscurity. Is the following enough to remove that title;
a ...
- 113
0
votes
2
answers
6k
views
How many attempts does it take to crack a 32-bit password hash with this scenario?
How many attempts does it take to crack (match) a 32-bit password hash from a database of 4 million password hashes?
Correct me if I'm wrong, but to crack a 32-bit password hash would take roughly 2^...
- 113
0
votes
1
answer
83
views
Are passwords generated from sine vulnerable to certain attacks?
A friend mentioned that he used the sine of a number, i.e. sind(54), to generate long passwords. This way he only has to remember sine 54 and have a calculator to get his password back. I am wondering ...
- 3
1
vote
2
answers
80
views
Automatic generation of secure passwords with the least inconvenience for a user
I'm working on a web site for a private company that should allow them to upload files, which will be later retrieved by their affiliates. The site will be available from a public Internet using ...
- 177
2
votes
1
answer
381
views
Any ideas on login using Digital Signature PKCS [closed]
I am curious to know about possibility to login into web application just by identifying the user based on digital signature in usb token.
any reference in this direction?
- 61
2
votes
2
answers
1k
views
Generate secure password hashes without access to PBKDF2 or bcrypt
Given is a system, which does provide only implementations of fast hash algorithms (MD5, SHA1, SHA-256, SHA-512). There is no implementation of PBKDF2, bcrypt or scrypt available. The system does ...
0
votes
2
answers
1k
views
Is there a client-side program to cryptography a HTML page and decode if correct password is writen? [closed]
I want to know if there is an easy way to do this:
create a complete HTML page
cryptography the text content (image is not important)
ask user some password
check the password with a cryptographed ...
- 111
1
vote
1
answer
196
views
Adding a Password Hash (key derivation) function to existing password storage solution
As always we are trying to improve password storage; before just adding new ways of storing our password we need to define what threats we will mitigate by adding in a new way to store our password.
...
- 11
10
votes
1
answer
3k
views
What are the security implications of multiple hashing?
There are plenty of questions on this site about hashing passwords. However, none of them quite cover this topic. One of those links covers using multiple different hash algorithms; one covers general ...
- 203
1
vote
1
answer
97
views
Protecting a short password
I figured that a really secure password would be an AES 128 key. If this key were to be base 64 encoded, I could replace 4 random bytes in it in order to make it unusable unless you know which bytes ...
- 113
1
vote
1
answer
136
views
Password generation/storage scheme
How bad is the following strategy for a password manager on a local machine?
The user wants to sign up for somesite.com where he needs a password.
The user has previously generated a secret key ...
- 11
11
votes
2
answers
2k
views
How secure is a pronounceable password in terms of entropy?
There are some strong studies which support the use of pronounceable passwords and multiple tools which provide generation of such passwords.
According to this question the entropy of a password ...
- 951
0
votes
2
answers
416
views
AES: Guess Password using the unencrypted text?
I am using the same password for some encrypted files currently (I know this is bad practice, though), and I wonder whether an attacker could decrypt if one decrypted file fell into his hands.
- 3
5
votes
1
answer
307
views
Is it safe to derive a password from a signature provided by ssh-agent?
I'd like to use a password-based system on a remote host (accessed via SSH) without having to copy-and-paste the password and without storing it on disk. Using the system with some other form of ...
- 51
0
votes
2
answers
1k
views
Database row level encryption scheme
I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
- 3
2
votes
1
answer
7k
views
How to calculate the entropy of passwords? [duplicate]
Here is a cartoon about password entropy. http://xkcd.com/936/
I dont quite understand how the entropy is calculated in the cartoon assuming they are calculate correctly. But in general, I dont have ...
- 359
1
vote
2
answers
1k
views
Strength and weaknesses of this JavaScript charCodeAt based login script
I know of a company on their website who are using this very basic password login page written in JavaScript. This doesn't seem very secure at all, because in the html source code it shows where the ...
- 113
2
votes
3
answers
1k
views
Implementing a web app where the server cannot decrypt its own data? [closed]
I'm a cryptography novice, but I think that the world needs to move towards an "encrypt everything" mentality as much as possible. As a result, I've been thinking a lot about ways to build a web app ...
- 121
3
votes
1
answer
251
views
Hashing passwords
The common way to store passwords in web applications is this form:
$$hash(password||salt)$$
Does it make sense to store them in the following form instead:?
$$hash_1(hash_2(...hash_n(password||salt))...
- 39
3
votes
1
answer
901
views
Strong key generation using PBKDF
I know that PBKDF2 is very useful for generating strong keys. I'm trying to know is there any additional contribution of the given password to produce even stronger keys.
Which key is more secure:
...
- 597
25
votes
3
answers
7k
views
Should you change salt when changing password?
Assume a password storage scheme using a computationally-expensive hash algorithm and a CSPRNG salt. User ID, salt, and hash value are stored in a table; if the table is compromised, all three ...
- 353
2
votes
1
answer
2k
views
Why are some key stretching methods better than others?
I'm trying to understand why some key stretching methods are better than others.
The wikipedia article presents 3 different key stretching methods:
A collision prone simple key stretching ...
- 121
2
votes
1
answer
824
views
PBKDF2-SHA256+SHA256 for password storage
I recently came across an interesting paper detailing the use of hardened session cookies. Each cookie includes a preimage of the password hash, and the preimage is hashed once more and compared to ...
- 173
3
votes
1
answer
568
views
PBKDF2 Salt and Password Ordering
I am currently reading about PBKDF2, and understand that the salt is used only once, while the password is used multiple times in the computation of the final key (see this question). How would the ...
- 173
7
votes
2
answers
4k
views
Maximum password length in PBKDF2
Haven't found any clear cut answer in Google so its up to you guys:
DK = PBKDF2(PRF, Password, Salt, c, dkLen)
Here, what is the upper limit of password length? ...
- 597
4
votes
2
answers
776
views
A patched SHA1 attempt for password verification
This is a classical scenario: For our web based authentication platform we have a username and a password field. User enters these values and presses Log In. The browser gathers the user data, ...
- 143
9
votes
4
answers
613
views
Using hashes as passwords
I have thought of a system for generating passwords which works as follows:
Take the following items:
A password, such as williamwallace.
A secret 1000 digit ...
- 193
4
votes
2
answers
899
views
Allowing multiple password reset tokens, and a question on random number predictability
I have a few requirements for a password reset system, along with some questions at the end as to its security.
Requirements
The aim is to provide a password reset mechanism satisfying the following ...
- 141
7
votes
2
answers
15k
views
How long does it take to crack PBKDF2?
How much time will it take to crack PBKDF2 while using a 9 character password? I'm not specifying any specific system or platform. If a brute force attack is made using the best ever super computer ...
- 597
2
votes
2
answers
1k
views
What is the entropy per Diceware word if a random symbol is inserted into a random position in the word?
On the Diceware page is this little gem:
For extra security without adding another word, insert one special character or digit chosen at random into your passphrase... Inserting a letter at random ...
user7024
3
votes
1
answer
203
views
Is there a practical upper limit for password rehashing?
When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security?
Note: If you answer “No”, that's fine. But if you answer: “There can't be an upper limit“, ...
- 1,965
5
votes
2
answers
2k
views
When only using one-way hashing, is it possible to tell the number of characters changed between the old and new password?
The other day when changing my password on a Solaris 10 system I was surprised that Solaris was able to detect that I hadn't changed enough characters between the new and current passwords.
MINDIFF ...
- 342
3
votes
3
answers
462
views
Do sites store login password with hash? If so, can people can use hash collision to log in?
I was researching about hash, and I thought, If sites store passwords with hash algorithms, then can't this happen:
User A has the password 'hello'
User B finds out the hash code of the password of ...
- 141
4
votes
2
answers
410
views
Using PBKDF2 twice with different argument order
I'm pretty sure this is a really bad approach (in theory), but one of my clients is doing this and I was wondering… How bad it is to perform pbkdf-2 in this way (with 2000 iterations)?
...
- 273
8
votes
1
answer
3k
views
Does salt size affect password hash security?
I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of ...
- 183
3
votes
2
answers
534
views
KDF followed by a Hash?
It is my understanding that a KDF adds entropy, whereas a hash loses information.
I've read that KDF should be used to store passwords. I don't understand why we don't use a KDF and then a hash, so ...
- 1,515
2
votes
1
answer
153
views
Is concatenated data hashed with scrypt vulunarable to a length extension attack?
scrypt takes a salt, and a password plus some cost paramters to generate a key. So say we define it as this:
key = scrypt(password, salt, cost)
I am interested ...
- 215
1
vote
1
answer
124
views
Numeric combination of passwords
Pls I need explanation on How i can design a Cryptography that use multiple passwords or passphrase to open a safe(Lock). For example, if i need five people to unlock a secured device whereby all the ...
- 13
1
vote
0
answers
222
views
Challenge–response authentication which can be done in head?
Say we have door where you have to say a password to pass. If theres someone standing nearby he would hear the password and could also use it. So therefore the doorman gives you a different number ...
- 11
3
votes
1
answer
474
views
Trying to calculate the strength of a Bitcoin brain wallet created with a custom diceware password
I want to create a brain wallet using a custom diceware since I don't like the original one. Instead of 7776 words it has 46656 because I use 6 dice for each word instead of 5, and also it only has ...
- 201
2
votes
1
answer
619
views
Strange Password Hashing
I know about PBKDF2, bcrypt, scrypt, etc. and while I'm not a crypt professional, I think I understand why are they better than just "hash(pass+salt)".
But a colleague of mine surprised me with the ...
- 175
2
votes
1
answer
390
views
Attacking hashed password by timing attack and other means
This question is inspired by this recent one, which raises a point that need to be made quantitative to be meaningfully discussed. I chose an unusual approach: a new question worded as homework that ...
- 137k
6
votes
3
answers
1k
views
Can passwords be stored securely so that a similarity comparison can be made?
On the Pro Webmasters StackExchange site, someone asked a question about a webapp (in this case cPanel) that refused to allow a password change because it was too similar to a previous password. I ...
- 161
7
votes
2
answers
3k
views
Why do I need to add the original salt to each hash iteration of a password?
I understand it is important to hash passwords over multiple iterations to make things harder for an attacker. I have read numerous times that when processing these iterations, it is critical to hash ...
- 73