Questions tagged [pbkdf-2]

The Password-Based Key Derivation Function 2 (PBKDF2) is a method of securely deriving encryption keys from a passphrase entered by a user. It features an iteration count that can be deliberately adjusted (key stretching) to slow down brute force password guessing attacks.

Filter by
Sorted by
Tagged with
0 votes
1 answer
91 views

Is AES GCM with PBKDF2 100k iterations still ok as of 2022?

Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022? In our threat model, if we ignore the risks linked to quantum computing, is this secure? Here is an example ...
user avatar
  • 481
1 vote
1 answer
58 views

Salt value in scrypt algorithm

I see there are a lot of questions relating to handling of a salt value but nothing I have seen so far has cleared the following question. When using a KDF such a scrypt, I believe the value of the ...
user avatar
  • 55
1 vote
2 answers
60 views

Is it reasonable to use DRBG and PBKDF together?

I want to generate a random number using DRBG with below follow: Entropy source -> DRBG -> PBKDF adding PBKDF is redundant ?
user avatar
  • 51
0 votes
1 answer
56 views

Selecting parameters for PBKDF2 using SHA3

I'm using PBKDF2 to generate an ED448 signing key, and I'm trying to figure out the optimal salt size for SHA-3. I recall reading a recommendation to use a salt size equal to the PRF's internal-state ...
user avatar
1 vote
1 answer
137 views

Where to store salt for PBKDF2 and initialization vector for AES via WebCrypto

I would like to build secure notes via javascript and webcrypto. I have found the possibilities to generate strong key via PBKDF2 and encrypt data via ...
user avatar
  • 133
1 vote
1 answer
146 views

Which passphrase length is good so it's hard to break bitcoin's PBKDF2 key?

According to https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#From_mnemonic_to_seed To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in ...
user avatar
0 votes
1 answer
121 views

To what degree does a high PKBDF-HMAC-SHA1 iteration count compensate for a weak passphrase entropy?

Lost a LUKS-encrypted laptop at the end of 2019 and now trying to figure out the odds of a very sophisticated attacker being able to break in. The LUKS container was created mid-2017 with LUKS1 ...
user avatar
1 vote
1 answer
129 views

How to reverse engineer Salt from password, iterations, and key?

Let's say that a random key is derived using the following function (PBKDF2). key = fn(password, salt, iterations) Q1: How can I reverse engineer the salt from the ...
user avatar
  • 113
7 votes
2 answers
1k views

Do I need to sanitize user input to scrypt, or to PBKDF's in general?

I'd like to allow the user to supply a password as input to some PBKDF, which I will use to construct a key for file encryption (currently using aes-256-ctr. It may change as I learn more). I am ...
user avatar
0 votes
0 answers
50 views

Managing master keys used in PBKDF2 and HMAC (store, rotate)

My use case: I have few master keys, I use each for a specific operation (e.g. one for encrypting user's data and another for creating JWT signatures etc...). I use these master keys in two specific ...
user avatar
0 votes
0 answers
36 views

PBKDF2 with pepper [duplicate]

The main purpose of PBKDF2 is to generate a strong key from a weak password by using an input (the weak password) and a salt (which is stored in plaintext). Is it useful to use a pepper with PBKDF2 ? ...
user avatar
0 votes
1 answer
307 views

How secure is AES 256bitkey generated from PBKDF2

I am using CryptoJS AES 256 encryption: CryptoJS.AES.encrypt(realData, generateKey(passphrase), {iv: iv}); The secret is generated through: ...
user avatar
0 votes
1 answer
133 views

How to securly save ED25519 private key on hard drive

I am developing an application which stores user's private Identity key (ed 25519) on user's hard drive without any security. What are the best practices / standards to save private key on hard drive, ...
user avatar
0 votes
0 answers
45 views

PBKDF2 Rounds Implementation Question?

Currently I am working on a implementation of PBKDF2 for an embedded microcontroller. My question is that my psuedo-random function is fixed (SHA-512 HMAC) how do perform 'rounds' of encryption? I am ...
user avatar
1 vote
0 answers
183 views

E2E Encryption w/ PBKDF2 + AES-GCM

I'm currently developing a product that requires user data to be encrypted on the client side. The product is a web app + a browser extension, so the focus is encrypting user data with Javascript. The ...
user avatar
1 vote
1 answer
235 views

Best practise for encryption in a password manager

I'm trying to make a password manager for Windows installed computers, and after researching the best ways to encrypt the passwords in the database (I'm new to cryptography) I think I've come up with ...
user avatar
1 vote
2 answers
154 views

Static salt for PBKDF2, but unique salt for HKDF?

Hypothetical. Lets say you have an application where you generate a master key from a user password using PBKDF2 (static salt) and then use the master key to derive two passwords keys for an encrypt-...
user avatar
  • 179
3 votes
1 answer
176 views

Is PBKDF2 with 1 iteration acceptable for a simple random key expansion?

I have a 128 bit randomly generated key. I need to expand this key to 512 bits to use with an existing encryption library that does AES-256 encryption in CBC mode with HMAC-SHA256 authentication. The ...
user avatar
  • 541
2 votes
1 answer
123 views

PBKDF2-HMAC Collisions

Trying to understand the well known property of these collisions when used with SHA1, SHA256, etc. where a given key is larger than the block size of the digest function. In these cases the smaller of ...
user avatar
  • 21
2 votes
1 answer
225 views

Random salt and PBKDF2 key

Suppose I wrote a function $$(salt,IV ) = \text{keyIVGenerator}(passwd)$$ which generates a random salt of size 32-bytes and a random Initialisation Vector (IV) of size 16-bytes. Then, use a Key ...
user avatar
  • 23
3 votes
1 answer
96 views

Why does PBKDF2 use HMAC?

When I learn PBKDF2, I found out most of the articles say that the PBKDF2 use HMAC as PRF. Why is HMAC? Can I use other pseudorandom functions? Is HMAC safer than any other functions for PBKDF2?
user avatar
1 vote
1 answer
51 views

Issue with decrypting self-coded AES

Summary: As a trainee, I got the task to extract encrypted passwords of our external password manager (Zoho Vault) and decrypt them. The documentation regarding how to decrpyt them is...none. I ask ...
user avatar
  • 11
0 votes
0 answers
103 views

Client-Side Encryption for a small app

I'm designing a small personal journal web application for my wife. I'm a crypto newb, but I want her to feel secure knowing only she will have access to her journal entries. I am thinking of the ...
user avatar
  • 1
2 votes
1 answer
88 views

Generate AES key from weak string

I'm trying to generate AES256 key from user input password. The size of the password can be anything from 4 bytes long to 32 bytes long but let's assume it is the smaller one. My API support either : ...
user avatar
2 votes
1 answer
48 views

What are the randomness requirements for inputs to PBKDF2?

I need to generate one 160-bit HMAC-SHA1 key for each user in my system. Can I use the username as the input to PBKDF2 function to generate the key? Is it safe to use known values like username as ...
user avatar
2 votes
0 answers
81 views

Content Key Encryption for Multi-User data access

I recently worked out a concept for a use-case, but I'm not sure if my approach is good enough. So I would appreciate feedback and things to look out for, as I'm fairly new to this field. A User can ...
user avatar
-1 votes
1 answer
97 views

Are there issues in how cryptography is used in this short code sample?

I want to encrypt some small text files so I can put them online, in non-restricted access (not the best idea, but it's cheap and simple). I know I should use something like Truecrypt instead of this, ...
user avatar
  • 693
1 vote
0 answers
33 views

AES implementation for non-password multi-document decryption usecase

I am trying to encrypt/decrypt multiple user documents (consider text) in an application. Unlike the use case of passwords where decryption happens once during an API call, in this application during ...
user avatar
6 votes
1 answer
641 views

Is it necessary to stretch/derive an AES key when I already have enough bytes from a 'cryptographically secure RNG'?

I'm using AES-CBC-256 with PKCS#7 compatible padding. I already have 32 bytes that come from a 'cryptographically secure random number generator'. In this scenario, does it make sense to use PBKDF2 to ...
user avatar
  • 175
6 votes
2 answers
2k views

Meaning of the term "Key Material"

I am reading specifications from my client that focuses on the topic of security. In these specs, the term key material has appeared many times. I used Google to look for what the term means. ...
user avatar
  • 161
0 votes
2 answers
179 views

KDF and salt storage

Regardless of the KDF I will use, let's imagine that I have to generate two keys: one for authentication and the other for encryption (which will always remain on the device that generates it until ...
user avatar
1 vote
1 answer
196 views

Are there cryptographical flaws in this e2ee website chat widget?

For a product I'm developing I want to verify if the thinking behind it is cryptographically strong and secure. The product is a chat widget on websites of customers. Like an e2ee version of Intercom. ...
user avatar
  • 111
0 votes
1 answer
305 views

Security of using constant salt when saving encrypted data to database

Let's say that I want to save some encrypted data to a database through a Spring Boot microservice. For that I will be using Spring Security Crypto that, as the documentation says it uses AES256 with ...
user avatar
1 vote
2 answers
325 views

Safest alternative for hashing credit card numbers to use the hash as fingerprint?

Same question asked here in 2014 but since a lot has changed since then, I would like to get feedback from experts on the latest best practices. The problem Our requirement is to provide the ...
user avatar
5 votes
1 answer
149 views

Line by line encrypted logging stored with iv/salt/iterations. How safe is it?

I'm building an encrypted logging application. Log entries are encrypted with AES-256-GCM, using password-derived keys with PBKDF2. The application must support log rotation, and I would like to make ...
user avatar
  • 183
1 vote
1 answer
765 views

AES PKCS5 Padding when it's not needed

I'm using AES/ECB with PKCS5 Padding (From what I've read, PKCS7 Padding is actually used internally) and PBKDF2(HMAC-SHA256) to encrypt some passwords in Java. I enter a password, that goes through ...
user avatar
0 votes
1 answer
350 views

is PBKDF2 reversible?

Given an AES key that is wrapped using another AES key, the second one being generated using PBKDF2, and given that I know the wrapped key: can I derive the passphrase that went into the PBKDF2? (...
user avatar
  • 119
1 vote
1 answer
87 views

can I use PBKDF2 instead of hmac as a hashing tool for sensitive data

I have read about hmac and PBKDF2. PBKDF2 - is mainly used for password hashing. It uses ...
user avatar
  • 113
1 vote
1 answer
958 views

Argon2 or scrypt instead of PBKDF2 with AES

Is using scrypt or argon2 a better key stretching technique with AES compared to PBKDF2 or bcrypt with regards to a quantum computer brute force attack. The brute force attack I'm referring to is ...
user avatar
  • 111
0 votes
0 answers
49 views

What's the use of HMAC in PBKDF2? [duplicate]

As far as I know, PBKDF2 uses an underlying pseudorandom function in order to generate a hash (like SHA256) so as far I understood PBKDF2 is basically a hash function that uses an underlying function ...
user avatar
  • 1
1 vote
1 answer
1k views

Why use PBKDF2 over SHA-512 to derive AES encryption key? [duplicate]

Suppose I am using user passwords to derive AES-128-CBC encryption key. This key will be used to encrypt some sensitive data for the user so that even the website owner / operator can not decrypt it. ...
user avatar
2 votes
2 answers
469 views

PBKDF2 with SHA-256/512 for low entropy input?

Is there any reason to use something stronger than SHA-1 with PBKDF2 if my input is fairly low entropy? I.e. if the passwords being hashed are only about 30-bits of entropy. I can't find it now, ...
user avatar
  • 123
3 votes
1 answer
520 views

Why does LastPass use exactly 100100 PBKDF2 rounds

LastPass encryption scheme is recently changed to use more PBKDF2 rounds, specifically 100100. This seems like a really weird number choose. From what I understand brute force time scales linearly ...
user avatar
2 votes
2 answers
336 views

What is the purpose of salting when integrating PBKDF2 with AES?

I'm a bit new to cryptography and I'm trying to wrap my head around PBKDF2 and AES. As a disclaimer, this is not going to be used in an actual application, I'm just testing things locally as a fun ...
user avatar
2 votes
2 answers
1k views

using different IV and SALT with AES-CBC but same KEY

I'm working on this project where a client can send a message, now obviously sending it in plainText is not very smart. So I decided to Encrypt it with AES-CBC. Now, each time I encrypt something, the ...
user avatar
2 votes
1 answer
65 views

What value for a Rfc2898 (PKBDF2) is overkill?

I am working on a project which needs to share messages, and part of that project is deriving a password, I am currently using a value of 65537, totally arbitrary (...
user avatar
5 votes
2 answers
3k views

Why cryptsetup default KDF is PBKDF2 and not Argon2(id)?

I plan to do a clean install of ArchLinux with Full Disk Encryption (with LUKS) but I'm not sure to understand the default KDF choice (PBKDF2+SHA-256). I didn't manage to find any pieces of evidence ...
user avatar
  • 171
4 votes
0 answers
83 views

Is there any difference in security between S2K and PBKDF2?

S2K, specified in RFC 4880 § 3.7.1.3, is a KDF designed for the OpenPGP standard which concatenates a password and salt and feeds this, repeating, into a hash function for a configurable number of ...
user avatar
  • 12.9k
4 votes
3 answers
1k views

Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?

I am going to store secrets from users. The secrets need to be stored confidentially. For this question, I am concerned only with confidentiality (not integrity). Here is how my encryption scheme is: ...
user avatar
2 votes
4 answers
3k views

How is PBKDF2 so much better than normal Hashing or even using HMAC

I do not know how the Key Length extension attack works. So if we leave that aside for once, and say just about usual brute-force attack on the hash, I don't really know how is PBKDF2 so much better ...
user avatar

1
2 3 4 5