Questions tagged [pbkdf-2]
The Password-Based Key Derivation Function 2 (PBKDF2) is a method of securely deriving encryption keys from a passphrase entered by a user. It features an iteration count that can be deliberately adjusted (key stretching) to slow down brute force password guessing attacks.
199
questions
1
vote
2answers
83 views
Safest alternative for hashing credit card numbers to use the hash as fingerprint?
Same question asked here in 2014 but since a lot has changed since then, I would like to get feedback from experts on the latest best practices.
The problem
Our requirement is to provide the ...
4
votes
1answer
72 views
Line by line encrypted logging stored with iv/salt/iterations. How safe is it?
I'm building an encrypted logging application. Log entries are encrypted with AES-256-GCM, using password-derived keys with PBKDF2.
The application must support log rotation, and I would like to make ...
0
votes
0answers
35 views
Help with PKCS#12 Cert/Key Bundle
I'm trying to construct a PKCS#12 cert + key bundle using browser-side Javascript so that key generation and storage can all happen locally. Since it's all local and goes from the browser directly ...
1
vote
1answer
60 views
AES PKCS5 Padding when it's not needed
I'm using AES/ECB with PKCS5 Padding (From what I've read, PKCS7 Padding is actually used internally) and PBKDF2(HMAC-SHA256) to encrypt some passwords in Java. I enter a password, that goes through ...
-1
votes
1answer
70 views
is PBKDF2 reversible?
Given an AES key that is wrapped using another AES key, the second one being generated using PBKDF2, and given that I know the wrapped key: can I derive the passphrase that went into the PBKDF2? (...
1
vote
1answer
48 views
can I use PBKDF2 instead of hmac as a hashing tool for sensitive data
I have read about hmac and PBKDF2.
PBKDF2 - is mainly used for password hashing. It uses ...
0
votes
1answer
82 views
Argon2 or scrypt instead of PBKDF2 with AES
Is using scrypt or argon2 a better key stretching technique with AES compared to PBKDF2 or bcrypt with regards to
a quantum computer brute force attack. The brute force attack I'm referring to is ...
0
votes
0answers
42 views
What's the use of HMAC in PBKDF2? [duplicate]
As far as I know, PBKDF2 uses an underlying pseudorandom function in order to generate a hash (like SHA256) so as far I understood PBKDF2 is basically a hash function that uses an underlying function ...
1
vote
1answer
114 views
Why use PBKDF2 over SHA-512 to derive AES encryption key? [duplicate]
Suppose I am using user passwords to derive AES-128-CBC encryption key. This key will be used to encrypt some sensitive data for the user so that even the website owner / operator can not decrypt it.
...
1
vote
2answers
165 views
PBKDF2 with SHA-256/512 for low entropy input?
Is there any reason to use something stronger than SHA-1 with PBKDF2 if my input is fairly low entropy? I.e. if the passwords being hashed are only about 30-bits of entropy.
I can't find it now, ...
3
votes
1answer
162 views
Why does LastPass use exactly 100100 PBKDF2 rounds
LastPass encryption scheme is recently changed to use more PBKDF2 rounds, specifically 100100. This seems like a really weird number choose. From what I understand brute force time scales linearly ...
2
votes
2answers
104 views
What is the purpose of salting when integrating PBKDF2 with AES?
I'm a bit new to cryptography and I'm trying to wrap my head around PBKDF2 and AES. As a disclaimer, this is not going to be used in an actual application, I'm just testing things locally as a fun ...
2
votes
2answers
205 views
using different IV and SALT with AES-CBC but same KEY
I'm working on this project where a client can send a message, now obviously sending it in plainText is not very smart. So I decided to Encrypt it with AES-CBC.
Now, each time I encrypt something, ...
2
votes
1answer
54 views
What value for a Rfc2898 (PKBDF2) is overkill?
I am working on a project which needs to share messages, and part of that project is deriving a password, I am currently using a value of 65537, totally arbitrary (...
3
votes
2answers
551 views
Why cryptsetup default KDF is PBKDF2 and not Argon2(id)?
I plan to do a clean install of ArchLinux with Full Disk Encryption (with LUKS) but I'm not sure to understand the default KDF choice (PBKDF2+SHA-256).
I didn't manage to find any pieces of evidence ...
2
votes
0answers
32 views
Is there any difference in security between S2K and PBKDF2?
S2K is a KDF designed for the OpenPGP standard which concatenates a password and salt and feeds this, repeating, into a hash function for a configurable number of bytes. PBKDF2 is a KDF which uses a ...
4
votes
3answers
973 views
Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?
I am going to store secrets from users. The secrets need to be stored confidentially. For this question, I am concerned only with confidentiality (not integrity).
Here is how my encryption scheme is:
...
1
vote
4answers
416 views
How is PBKDF2 so much better than normal Hashing or even using HMAC
I do not know how the Key Length extension attack works. So if we leave that aside for once, and say just about usual brute-force attack on the hash, I don't really know how is PBKDF2 so much better ...
0
votes
0answers
32 views
What is used as a KEY and MESSAGE when using HMAC within a PBKDF2? [duplicate]
I was studying WPA2 and it's security when I came across this problem. I know that WPA2 uses PBKDF2 to generate a Pairwise Master Key. It does something like this;
...
1
vote
1answer
113 views
Can you derive a 128 bit AES encryption key using PBKDF2 with SHA-256
I got confused about key derivation functions. For my project, I need to derive a 128 bits AES encryption key in CTR mode. To do so, I'm using a PBKDF2 to derive this encryption key using an initial ...
2
votes
3answers
90 views
“Work factor” and “iteration count” nomenclature in adaptive functions
In adaptive functions like PBKDF2 / bcrypt I often read people refer to "iteration count" and others refer to "work factor", and they seem to be used interchangeably (even though they're not - the ...
0
votes
2answers
804 views
How to validate a PBKDF2 password
I want to encrypt several files correctly with a PBKDF2 generated key (using a password and salt), I am currently doing so but if I enter the wrong password, as expected an exception occurs.
Note: ...
1
vote
1answer
65 views
One way hash of data records (PBKDF2?)
I'm looking for a way of one way hash data for multiple records. We have a privacy requirement to anonymise information "after it's used for its intended purpose" which is a little wooly at best.
I'd ...
4
votes
1answer
477 views
Why derive keys from a master key instead of generating random keys?
I noticed AWS KMS generates encryption keys based off of a master key, using a key derivation function (HKDF).
What's the practical advantage of deriving keys based on a master key? Isn't it simpler ...
3
votes
1answer
166 views
Using a KDF (PBKDF2) properly
I am new to crypto.
I have a password for my user, e.g. &&38:while:HAVE:havana:60&&
I want to encrypt several documents with 10 pages each with AES....
2
votes
1answer
425 views
Is it safe to split the output of PBKDF2?
I would like to know if splitting a key generated by PBKDF2 to derive two keys is a safe practice.
Concretely, in my system, I need to derive two keys. One for symmetric cipher used in the client ...
2
votes
3answers
167 views
Deriving a key from a pseudo-random string
I would like to know if deriving a key from a pseudo-random string with a single iteration is secure.
Concretely, I am designing a system where a secret key is derived in the client side, and then ...
1
vote
1answer
162 views
How to make my hash more robust to the brute force?
I'm using PBKDF2 SHA 256 with 100 000 iterations to generate a secret.
I want to increase the cost of brute forcing the passphrase I use to generate the secret.
I'm thinking of using scrypt after ...
3
votes
1answer
148 views
What is the most secure way to check that a given masterkey is valid?
For the purposes of learning, I'm writing a small utility that allows encrypting a list of passwords using a single master key (using AES-256 and PBKDF2)
Before encrypting or decrypting any password ...
-1
votes
1answer
87 views
How many bits should I request from PBKDF2 to create a strong password?
I'm building a tool which generates passwords by hashing a service name with a master key. PBKDF2 was primarily chosen due to availability in the Web Crypto API.
What would be a secure value for the ...
3
votes
2answers
427 views
KDF Salt: How/When is it Okay for it to be public?
Post Structure:
Prior source material studied
Question & Details
Assumed threat model
Example
Assumptions
Clarifications
Prior source material studied
0.1. RFC 2898
0.2. HAC (Handbook of ...
2
votes
2answers
115 views
Can one trade off the number of iterations for key length with the PBKDF2?
When using the PBKDF2, is one taking on significant risk if one chooses to lower the number of iterations and choose to have very long keys?
Can I XOR my message with a a very long key (plain-text ...
2
votes
1answer
147 views
Does it matter if I append the secret to the salt or pass it in separately?
I'm using PBKDF2, and this is my current call.
key = pbkdf2-hmac-sha256(iterations = 100_000, secret = password ++ salt)
I recently learnt that the function I'm ...
1
vote
1answer
128 views
Does having an SHA256 hash compromise PBKDF2 secrecy?
If I have a password pwd, and I hash it with SHA256 and send it to a server for authentication (server will apply ...
1
vote
2answers
996 views
Should number of iterations of PBKDF2 stay secret?
Let's say I encrypt my passwords with PBKDF2 and store it somewhere. Now let's say it was stolen and the hacker, who stole it knows it was hashed with PBKDF2.
Does a knowledge of number of iterations ...
0
votes
2answers
133 views
Client-side password stretching - danger of the salt being public?
In case of using client-side password stretching (plus a single hash on the server) - the server would need to send the salt before authentication, of course.
Though the salt is not considered a real ...
5
votes
2answers
243 views
Are PBKDF2 derived keys related if only the number of iterations is changed?
I'd like to encrypt my disk with a password.
To generate a nice key from a password, I used PBKDF2, which applies a hash function $k$ times to a cleartext and outputs the final result.
When I ...
2
votes
2answers
150 views
Does PBKDF2 reveal any knowledge about the salt?
DK = PBKDF2(PRF, Password, Salt, c, dkLen)
When PBKDF2 is used for key derivation (not password hashing), is it possible for an adversary who doesn't know ...
3
votes
2answers
567 views
The logic of preferring PBKDF2 over iterative SHA2
I have studied PBKDF2 for the application of hashing passwords, and frankly I don't understand the justification for the complexity of PBKDF2 over iterative hashing with a cryptographic hash function.
...
0
votes
1answer
3k views
Create key for AES-256 in Node.JS [closed]
I'm trying to create a strong key for encrypting some data using AES-256 for fun and practice. For my own practice, I want to make this as strong as possible, I don't care how long it takes to ...
2
votes
1answer
463 views
Is transporting a salt, IV, ciphertext and HMAC in an encrypted token an acceptable practice?
I’m porting over some crypto code from Mcrypt (deprecated) to OpenSSL. I’m following a process that a former employee implemented, which is as follows:
Create a random salt for use in a PBKDF2 key ...
5
votes
1answer
568 views
Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?
PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
1
vote
1answer
469 views
Storing Salt in Ciphertext?
I found the cryptomator encryption documentation online, because I was looking for something to learn about x). I altered the process a bit to fit "my need" / so that I would not have a vault, but a ...
2
votes
2answers
167 views
Mechanism of PBKDF in encryption key generation with passphrase
I want to roughly understand how the mechanism works of generating an encryption key from a passphrase, by which we encrypt a volume or file.
I'm familiar with public key encryption, the concept of a ...
2
votes
2answers
185 views
Multithreading PBKDF2 or javascript alternative
I'm using PBKDF2 in browser (can't use bcrypt, users are likely to have passwords > 72bytes, or whatever the number was). PBKDF2 is running in a webworker, something like so
...
-1
votes
2answers
219 views
Is HMAC a suitable substitute for HKDF?
My PHP version does not include the hash_hkdf() function, and upgrading versions is not worth the trouble for my project (which is for personal pleasure, not for ...
1
vote
4answers
987 views
I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error
People seem to mostly recommend scrypt these days, but I'm not sure if this should be the case? I'll structure this post by just making an argument for PBKDF2 over Scrypt and then you can reply ...
3
votes
4answers
286 views
How many bits of entropy are leaked for every derived password from a master?
Given a master password that has a lot of entropy (similar to Bitcoin HD wallet seed words, 130 bits of entropy or more) how many bits of entropy are lost per leaked generated password?
Let's take an ...
3
votes
2answers
221 views
PBKDF2 with longer than native output length - Will hashing the result help?
I've seen it mentioned more than once that PBKDF2 should not be used to create a longer key than the native output (such as 160 bits when used with HMACSHA1). Since an attacker could test only the ...
2
votes
2answers
850 views
HMACSHA1 vs HMACSHA2 (for PBKDF2)
I need to choose an HMAC function for PBKDF2.
I'm using .net so I don't have the option to use SHA3. At first glance, and according to this answer by Thomas Pornin it seems like SHA512 would be best....
