Questions tagged [pbkdf-2]
The Password-Based Key Derivation Function 2 (PBKDF2) is a method of securely deriving encryption keys from a passphrase entered by a user. It features an iteration count that can be deliberately adjusted (key stretching) to slow down brute force password guessing attacks.
3
votes
2answers
80 views
KDF Salt: How/When is it Okay for it to be public?
Post Structure:
Prior source material studied
Question & Details
Assumed threat model
Example
Assumptions
Clarifications
Prior source material studied
0.1. RFC 2898
0.2. HAC (Handbook of ...
2
votes
2answers
51 views
Can one trade off the number of iterations for key length with the PBKDF2?
When using the PBKDF2, is one taking on significant risk if one chooses to lower the number of iterations and choose to have very long keys?
Can I XOR my message with a a very long key (plain-text ...
2
votes
1answer
61 views
Does it matter if I append the secret to the salt or pass it in separately?
I'm using PBKDF2, and this is my current call.
key = pbkdf2-hmac-sha256(iterations = 100_000, secret = password ++ salt)
I recently learnt that the function I'm ...
1
vote
1answer
56 views
Does having an SHA256 hash compromise PBKDF2 secrecy?
If I have a password pwd, and I hash it with SHA256 and send it to a server for authentication (server will apply ...
1
vote
2answers
195 views
Should number of iterations of PBKDF2 stay secret?
Let's say I encrypt my passwords with PBKDF2 and store it somewhere. Now let's say it was stolen and the hacker, who stole it knows it was hashed with PBKDF2.
Does a knowledge of number of iterations ...
0
votes
2answers
66 views
Client-side password stretching - danger of the salt being public?
In case of using client-side password stretching (plus a single hash on the server) - the server would need to send the salt before authentication, of course.
Though the salt is not considered a real ...
3
votes
2answers
70 views
Are PBKDF2 derived keys related if only the number of iterations is changed?
I'd like to encrypt my disk with a password.
To generate a nice key from a password, I used PBKDF2, which applies a hash function $k$ times to a cleartext and outputs the final result.
When I ...
2
votes
2answers
82 views
Does PBKDF2 reveal any knowledge about the salt?
DK = PBKDF2(PRF, Password, Salt, c, dkLen)
When PBKDF2 is used for key derivation (not password hashing), is it possible for an adversary who doesn't know ...
3
votes
2answers
168 views
The logic of preferring PBKDF2 over iterative SHA2
I have studied PBKDF2 for the application of hashing passwords, and frankly I don't understand the justification for the complexity of PBKDF2 over iterative hashing with a cryptographic hash function.
...
0
votes
0answers
42 views
JSON Web Encryption: direct password-based encryption with PBES2
So the JOSE spec describes using password-based encryption for key wrapping, but what about using PBES2 for content encryption directly, rather than using an intermediary key?
Here is what I would ...
0
votes
1answer
1k views
Create key for AES-256 in Node.JS [closed]
I'm trying to create a strong key for encrypting some data using AES-256 for fun and practice. For my own practice, I want to make this as strong as possible, I don't care how long it takes to ...
2
votes
1answer
113 views
Is transporting a salt, IV, ciphertext and HMAC in an encrypted token an acceptable practice?
I’m porting over some crypto code from Mcrypt (deprecated) to OpenSSL. I’m following a process that a former employee implemented, which is as follows:
Create a random salt for use in a PBKDF2 key ...
3
votes
1answer
231 views
Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?
PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
1
vote
1answer
139 views
Storing Salt in Ciphertext?
I found the cryptomator encryption documentation online, because I was looking for something to learn about x). I altered the process a bit to fit "my need" / so that I would not have a vault, but a ...
1
vote
2answers
59 views
Mechanism of PBKDF in encryption key generation with passphrase
I want to roughly understand how the mechanism works of generating an encryption key from a passphrase, by which we encrypt a volume or file.
I'm familiar with public key encryption, the concept of a ...
2
votes
2answers
124 views
Multithreading PBKDF2 or javascript alternative
I'm using PBKDF2 in browser (can't use bcrypt, users are likely to have passwords > 72bytes, or whatever the number was). PBKDF2 is running in a webworker, something like so
...
-1
votes
2answers
78 views
Is HMAC a suitable substitute for HKDF?
My PHP version does not include the hash_hkdf() function, and upgrading versions is not worth the trouble for my project (which is for personal pleasure, not for ...
0
votes
4answers
448 views
I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error
People seem to mostly recommend scrypt these days, but I'm not sure if this should be the case? I'll structure this post by just making an argument for PBKDF2 over Scrypt and then you can reply ...
3
votes
4answers
208 views
How many bits of entropy are leaked for every derived password from a master?
Given a master password that has a lot of entropy (similar to Bitcoin HD wallet seed words, 130 bits of entropy or more) how many bits of entropy are lost per leaked generated password?
Let's take an ...
2
votes
2answers
92 views
PBKDF2 with longer than native output length - Will hashing the result help?
I've seen it mentioned more than once that PBKDF2 should not be used to create a longer key than the native output (such as 160 bits when used with HMACSHA1). Since an attacker could test only the ...
2
votes
2answers
436 views
HMACSHA1 vs HMACSHA2 (for PBKDF2)
I need to choose an HMAC function for PBKDF2.
I'm using .net so I don't have the option to use SHA3. At first glance, and according to this answer by Thomas Pornin it seems like SHA512 would be best....
0
votes
1answer
253 views
Web Crypto API - deriveKey vs. deriveBits? [closed]
I have some questions about deriveKey and deriveBits for web crypto API.
I am confused about the state of these APIs. I do ...
2
votes
1answer
167 views
Does this PBKDF2-SHA1 payload hint at a cryptographic security issue?
Blockchain first 16 encrypted bytes, IV, and iter_count – all encoded in Base64:
Yms6xqrzCfFsQadVZ5gQonMtnQAAAAAAAAAAAAAAAAAAAAAQJwAA69tYNg==
Does it looks like “...
14
votes
2answers
2k views
Password hash that can be upgraded without plaintext password
Most password hashes have a cost parameter that indicates how long the algorithm should take. Is there an algorithm where you can increase that cost for a particular hash, without access to the ...
0
votes
0answers
306 views
Cracking a PBKDF2 hash with known salt but unknown iterations
My understanding is: if there is a data breach it likely includes enough of the source code that the hashing method is known. If the plain text was hashed using PBKDF2, algorithm="SHA-512", the salt ...
7
votes
1answer
334 views
Is it safe to store both the AES-related data and the PBKDF2-related data (except passwords) in one file?
Assume an "encrypted data package" file format which includes the following data
PBKDF2
algorithm
salt
rounds
keylen
AES
algorithm & mode
IV
ciphertext
where the PBKDF2 salt and AES IV are ...
1
vote
2answers
223 views
Argon2id internal iterations vs multiple Argon2id calls ?
TLDR;
Is there a security risk if rather than setting the iteration parameter to 12 (for example), we set it to 3 but call the function 4 times?
I'm asking that for 2 reasons:
Firstly, we use SRP ...
2
votes
1answer
1k views
Apple secure notes. How secure?
In terms of cryptography, how secure is Apple Secure Notes? Can one store sensitive information there? The relevant section of the Apple white paper is quoted below:
The Notes app includes a Secure ...
4
votes
4answers
763 views
Rehashing PBKDF2 hashes - do iterations stack?
Let's suppose I have a bunch of PBKDF2 hashes in a database. For the sake of keeping this simple, let's say I've used 10 iterations. A few years later I decide to upgrade to 20 iterations. I want to ...
1
vote
2answers
112 views
KDF-based password manager
I want to make a password manager that from a single master password generates passwords for my services. For that I thought that HKDF suits my needs, as it is able to generate multiple keys from a ...
1
vote
1answer
362 views
HMAC vs PKDBF2 as the first step towards HKDF
I'm implementing an application that from a password has to derive two keys, one for authentication with the server, one for encryption. I'm using Java, with JCA and Bouncy Castle.
So far, to ...
1
vote
1answer
116 views
How to generate two different keys out of a single password?
I'm designing a system in which a password is used both for logging in as well as for encrypting some payload.
To encrypt a payload I derive a key from the password. Very straightforward so far.
...
4
votes
1answer
408 views
Some Questions about the Veracrypt hash functions
Veracrypt has always been my favourite encryption tool since it came out .
But still there are some things about the tool I don't understand .
Why is there the possibility to use sha256 or sha512 .
...
0
votes
1answer
884 views
Proper number of salt bytes for Rfc2898DeriveBytes/PBKDF2
I know that .NET's Rfc2898DeriveBytes requires at least 8 bytes of salt, but how many bytes are ideal?
When a user is created, or changes their password, my server stores a new random salt for that ...
1
vote
1answer
490 views
What is meant by “KDF2” vs “PBKDF2”?
I see many references to KDF2 here, but all links are broken and Wikipedia does not have an entry for KDF2. Is KDF2 a specific standard for Key Derivation without a password?
Ultimately, I am trying ...
3
votes
1answer
506 views
Can pbkdf2 be used with a fixed salt to give a deterministic slow hash?
I need a password hashing function that is deterministic. Correlation attacks are not a concern. The same password must produce the same hash. I just want to protect the password against dictionary ...
1
vote
1answer
96 views
Ensuring no unintended leaking before authentication
Assume my authentication system consists of querying an endpoint to get sign in parameters cost and salt, ...
1
vote
1answer
86 views
Do PBKDF2 keys generated at a lower iteration count leak information?
Assume the threat model here is that the server is not to be trusted and the client is trusted. A user registers for an account and the client chooses an iteration count of 50,000 to generate a 512 ...
0
votes
0answers
43 views
Authenticating PBKDF2 params from the server
In my app, I use PBKDF2 to stretch a user inputted password. I split the result in two: the first half is stored locally as an encryption key (and never sent to the server), and the second half is ...
1
vote
1answer
153 views
Generating HMAC-SHA256 - is this procedure secure enough?
I have 256-bit value (call it "{Secret Value}") and I would like to compute HMAC-SHA256 digest of this value to check its ...
1
vote
1answer
455 views
Must a key for a HMAC-SHA256 digest kept secure?
I need to check integrity of high secure system value - in this case encryption key(s)
I would like to create HMAC digest of this user encryption key (key is used ...
3
votes
1answer
612 views
Argon2i versus Argon2d?
I am planning to use Argon2 in my Android app to encrypt some sensitive info that is only stored on the user's phone (in an SQLite DB) and not exported anywhere else. From documentation I see that ...
5
votes
1answer
770 views
Why does LastPass hash their passwords with PBKDF2 this way?
LastPass is a password manager that I am sure many of you are familiar with. I have been studying LastPass's source code a bit. From their FAQs and what I can gather from their source code, the way ...
6
votes
1answer
2k views
Is PBKDF2/RFC 2898 broken because SHA1 is broken?
I was attempting to re-implement the ASP.NET Identity password hash algorithm in PHP. It uses RFC 2898, which uses HMAC SHA1. SHA1 has been broken by google. Does this mean that RFC 2898 in general ...
3
votes
1answer
319 views
Is it a vulnerability (for message authentication) to have a variable iteration-count for PBKDF2?
The scenario: A user clicks on an encrypted file, and enters his password, in order to decrypt and authenticate it using HMAC (when its key is derived using PBKDF2). If the iteration-count is fixed, ...
1
vote
1answer
75 views
Is creating an authentication-key (mac) from the encryption password a vulnerability?
I can think of at least one problem with it - that testing for a correct key (when brute forcing) is simpler with a mac key (at least for short messages) and therefore can help brute force decryption.
1
vote
2answers
109 views
Can a attacker compute a hash from another hash of the same plaintext (both using different salt)?
Imagine two PBKDF2-SHA-512 hashes of the same password are generated. Each has individual salt. If an attacker had one hash and the salt of both hashes, would he be able to compute the missing hash or ...
1
vote
1answer
214 views
Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?
How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. ...
1
vote
1answer
352 views
Question about hashing passwords with PBKDF2
I am new here and new to encrypting and securing passwords, so please forgive me if this question is not posted to the right location or if my question is bad.
I have been working on a web app in ...
4
votes
1answer
260 views
Upgrade password hash in an existing system: Pbkdf2( salt , OldSha1Hash )
Background [Updated]
Consider a situation where a website was created over a decade ago and user account password storage was done by storing SHA1(password) into ...
