Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [pbkdf-2]

The Password-Based Key Derivation Function 2 (PBKDF2) is a method of securely deriving encryption keys from a passphrase entered by a user. It features an iteration count that can be deliberately adjusted (key stretching) to slow down brute force password guessing attacks.

Filter by
Sorted by
Tagged with
38 votes
4 answers
34k views

How can one securely generate an asymmetric key pair from a short passphrase?

Background info: I am planning on making a filehost with which one can encrypt and upload files. To protect the data against any form of hacking, I'd like not to know the encryption key ($K$) used for ...
Flumble's user avatar
  • 485
25 votes
2 answers
54k views

What's the difference between PBKDF and SHA and why use them together?

I've been reading a little bit about hashing lately and according to AgileBits, they use "SHA512 within PBKDF2" in their new vault file. I've looked in Wikipedia for both names and I know PBKDF2 is a ...
Danowsky's user avatar
  • 353
25 votes
2 answers
18k views

What is the difference between Scrypt and PBKDF2?

After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2. As far as I understood, the similarity is: both are password-based key derivation ...
Salvador Dali's user avatar
24 votes
6 answers
48k views

PBKDF2 and salt

I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions. Actually we use the derivation function together with the salt to provide ...
thrylos_7's user avatar
  • 341
17 votes
2 answers
2k views

Password hash that can be upgraded without plaintext password

Most password hashes have a cost parameter that indicates how long the algorithm should take. Is there an algorithm where you can increase that cost for a particular hash, without access to the ...
Sjoerd's user avatar
  • 661
16 votes
2 answers
2k views

Why is the salt used only once in PBKDF2, while the password is used often?

The purpose of PBKDF2 is to create a derived key (DK) from a master password (PW) and a salt, often using a function like HMAC-SHA256. I have read that the salt should be as random as possible. But ...
ericball's user avatar
  • 413
14 votes
3 answers
4k views

PBKDF2 for key diversification

I am looking for a secure key diversification function to create individual AES keys for a local smart card deployment. The keys need to be derived from a secret master key and the smart card serial ...
ge0rg's user avatar
  • 243
14 votes
2 answers
2k views

How to derive two keys from one password

What is the best way to generate two independent symmetric keys from one user-entered password or passphrase? Would using both scrypt and pbkdf2 achieve this?
user1028028's user avatar
14 votes
2 answers
11k views

Is PBKDF2-HMAC-SHA1 really broken?

I just read through this article which demonstrates practical (and seemingly trivial) collisions in PBKDF2-HMAC-SHA1, and provides a few examples of collisions. Am I missing something here? Is PBKDF2-...
Polynomial's user avatar
  • 3,527
12 votes
3 answers
4k views

Is deriving the IV from the password secure?

I came across an encryption scheme to encrypt files with AES-256. You can see the initialization of the decryption routine below: ...
Jonas's user avatar
  • 223
11 votes
1 answer
3k views

How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?

When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure: Using PBKDF2 with then entire 128 bit ...
jbtule's user avatar
  • 278
11 votes
2 answers
11k views

Should I salt an AES password at each encryption?

I saw a sample code where the same password is salted with a different value (using PBKDF2) for each encryption. That means that the salt must be stored for each encrypted message. I don't understand ...
Benoit's user avatar
  • 113
11 votes
1 answer
1k views

Does a big salt have the same memory effects as Bcrypt?

Citing Thomas Pornin on the question Why can't one implement bcrypt in Cuda?: bcrypt is a variant of the Blowfish key scheduling, which is defined over a table (a few kilobytes) which is constantly ...
Luc's user avatar
  • 1,518
11 votes
3 answers
28k views

PBKDF2WithHmacSHA512 Vs. PBKDF2WithHmacSHA1?

I'm working on a Java authentication subsystem that specs the storage of passwords in the DB as PBKDF2-generated hashes, and I'm now trying to decide whether I ...
Jim's user avatar
  • 111
11 votes
2 answers
5k views

Meaning of the term "Key Material"

I am reading specifications from my client that focuses on the topic of security. In these specs, the term key material has appeared many times. I used Google to look for what the term means. ...
mac.ma's user avatar
  • 211
10 votes
1 answer
13k views

How do I store encrypted files on a web server and decrypt them locally?

I want to store files (images) on a public webserver and let users see them if they know a password. The server shouldn't have the unecrypted files and the server can only serve files, not perform ...
Eyal's user avatar
  • 405
9 votes
1 answer
6k views

KDF and number of iterations for GPG

I gather, from reading the GPG manual, that symmetric encryption based on a password uses one of a variety of Key Derivation Functions (KDF). Although not explicitly mentioned I assume that PBKDF2 is ...
Quinton G's user avatar
  • 153
9 votes
1 answer
14k views

How do I correctly derive a Key and IV?

Mainly I'm trying to understand how to correctly create the Key and IV for use with the .NET Implementation of AES (AesManaged class). This encryption code will be used in conjunction with existing ...
John B's user avatar
  • 193
8 votes
2 answers
12k views

What are KDF parameters in OpenSSL command-line utility for `enc`?

I refer to https://www.openssl.org/docs/manmaster/apps/enc.html and see that the only parameter for key derivation which I can set explicitly (not considering the obvious ...
A gee's user avatar
  • 83
8 votes
2 answers
2k views

AES encrypting multiple files

So if I want to encrypt all the files in a folder with AES (same password) I take each file and generate the key schedule using PBKDF2. As the PBKDF2 algorithm takes in a salt then this salt should ...
winterfell's user avatar
8 votes
3 answers
1k views

Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
Jason's user avatar
  • 373
8 votes
2 answers
7k views

Why cryptsetup default KDF is PBKDF2 and not Argon2(id)?

I plan to do a clean install of ArchLinux with Full Disk Encryption (with LUKS) but I'm not sure to understand the default KDF choice (PBKDF2+SHA-256). I didn't manage to find any pieces of evidence ...
Rand0mMan's user avatar
  • 223
8 votes
1 answer
3k views

Does salt size affect password hash security?

I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of ...
Pascal Bergeron's user avatar
8 votes
1 answer
2k views

Why does LastPass hash their passwords with PBKDF2 this way?

LastPass is a password manager that I am sure many of you are familiar with. I have been studying LastPass's source code a bit. From their FAQs and what I can gather from their source code, the way ...
izzle's user avatar
  • 591
7 votes
2 answers
1k views

Do I need to sanitize user input to scrypt, or to PBKDF's in general?

I'd like to allow the user to supply a password as input to some PBKDF, which I will use to construct a key for file encryption (currently using aes-256-ctr. It may change as I learn more). I am ...
phoenixdown's user avatar
7 votes
2 answers
15k views

How long does it take to crack PBKDF2?

How much time will it take to crack PBKDF2 while using a 9 character password? I'm not specifying any specific system or platform. If a brute force attack is made using the best ever super computer ...
Giliweed's user avatar
  • 597
7 votes
1 answer
3k views

Argon2i versus Argon2d?

I am planning to use Argon2 in my Android app to encrypt some sensitive info that is only stored on the user's phone (in an SQLite DB) and not exported anywhere else. From documentation I see that ...
Shahid Thaika's user avatar
7 votes
2 answers
5k views

Maximum password length in PBKDF2

Haven't found any clear cut answer in Google so its up to you guys: DK = PBKDF2(PRF, Password, Salt, c, dkLen) Here, what is the upper limit of password length? ...
Giliweed's user avatar
  • 597
7 votes
2 answers
1k views

Can I use PBKDF2 as a stream cipher?

Unfortunately I have to implement some naive homemade symmetric crypto, since ordinary AES CTR is not implemented in available API on target platform. What I’m going to do is, given encryption ...
Viktor Pti's user avatar
7 votes
1 answer
2k views

Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?

PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
forest's user avatar
  • 15.3k
7 votes
1 answer
744 views

Is it safe to store both the AES-related data and the PBKDF2-related data (except passwords) in one file?

Assume an "encrypted data package" file format which includes the following data PBKDF2 algorithm salt rounds keylen AES algorithm & mode IV ciphertext where the PBKDF2 salt and AES ...
e-sushi's user avatar
  • 17.9k
7 votes
2 answers
4k views

Encryption Key derivation from numeric PIN?

I want to store data encrypted within an Android application. Keeping an encryption key safe outside the app is not an option so I looked into password derived key algorithms. I found a nice example ...
Hans Cappelle's user avatar
6 votes
3 answers
3k views

Can I use PBKDF2 for authentication and decryption?

I want to store a hash for authenticating a password. I also want to use the same password for decryption. Can I use PBKDF2 for both? (I plan to use different salts for the authentication and the ...
Eyal's user avatar
  • 405
6 votes
1 answer
954 views

Is it necessary to stretch/derive an AES key when I already have enough bytes from a 'cryptographically secure RNG'?

I'm using AES-CBC-256 with PKCS#7 compatible padding. I already have 32 bytes that come from a 'cryptographically secure random number generator'. In this scenario, does it make sense to use PBKDF2 to ...
wujek's user avatar
  • 175
6 votes
1 answer
4k views

Is PBKDF2/RFC 2898 broken because SHA1 is broken?

I was attempting to re-implement the ASP.NET Identity password hash algorithm in PHP. It uses RFC 2898, which uses HMAC SHA1. SHA1 has been broken by google. Does this mean that RFC 2898 in general ...
Justin Dearing's user avatar
6 votes
1 answer
13k views

Apple secure notes. How secure?

In terms of cryptography, how secure is Apple Secure Notes? Can one store sensitive information there? The relevant section of the Apple white paper is quoted below: The Notes app includes a Secure ...
Adam Smith's user avatar
6 votes
1 answer
240 views

Are shorter password hashes safe?

How much can I shorten a password hash before it begins to impact security? Suppose that I use PBKDF2 (correctly salted) with HMAC-SHA256 as the PRF. From what I've seen, it's typical to use 256 ...
Tim McLean's user avatar
  • 2,844
6 votes
1 answer
1k views

Computing IV for CBC from PBKDF2 + HKDF

Note that this question is somewhat similar to Can I use my random IV (for AES) as a salt for PBKDF2? My current encryption format computes two random PBKDF2 salts (encryption and HMAC, 8 bytes each) ...
Rob Napier's user avatar
6 votes
1 answer
2k views

Why derive keys from a master key instead of generating random keys?

I noticed AWS KMS generates encryption keys based off of a master key, using a key derivation function (HKDF). What's the practical advantage of deriving keys based on a master key? Isn't it simpler ...
Shruggie's user avatar
  • 237
6 votes
1 answer
2k views

AES file encryption with PBKDF2. Safe parameters?

I'm developing an application that will use public key authentication to contact some webservice. So the user has his keypair on his computer, and I want that file to be encrypted using AES with a key ...
Syrian Watermelon's user avatar
5 votes
4 answers
1k views

Rehashing PBKDF2 hashes - do iterations stack?

Let's suppose I have a bunch of PBKDF2 hashes in a database. For the sake of keeping this simple, let's say I've used 10 iterations. A few years later I decide to upgrade to 20 iterations. I want to ...
Lukas's user avatar
  • 53
5 votes
1 answer
1k views

Can I use my random IV (for AES) as a salt for PBKDF2?

Also, where do I store my salt (can I just store it at the beginning of the encrypted file)?
winterfell's user avatar
5 votes
1 answer
695 views

Injecting salt into PyCrypto KDF - useful?

I have noted some sources indicate that when using a KDF like PBKDF2 (alternatively) some advocate injecting the salt at the time of execution - like this: ...
Brian M. Hunt's user avatar
5 votes
1 answer
290 views

Line by line encrypted logging stored with iv/salt/iterations. How safe is it?

I'm building an encrypted logging application. Log entries are encrypted with AES-256-GCM, using password-derived keys with PBKDF2. The application must support log rotation, and I would like to make ...
aspyct's user avatar
  • 183
5 votes
2 answers
809 views

Are PBKDF2 derived keys related if only the number of iterations is changed?

I'd like to encrypt my disk with a password. To generate a nice key from a password, I used PBKDF2, which applies a hash function $k$ times to a cleartext and outputs the final result. When I modify ...
theaspirer's user avatar
5 votes
1 answer
2k views

PBKDF2 PRF: HMAC or just hash?

I understand the way $\textrm{PBKDF2}$ can be used to 'stretch' a password/passphrase that does not provide full entropy. My question: how does one choose the PRF? A common choice is any well-known ...
DiscobarMolokai's user avatar
5 votes
1 answer
641 views

Is SHA256 good enough to shrink a key?

I have a key that is the combination of two shorter keys generated by PBKDF2, which together are long more or less 64 bytes. Now I need to shrink it down to 32 bytes and I'm not sure what to use to do ...
Marcello's user avatar
  • 347
5 votes
1 answer
679 views

Upgrade password hash in an existing system: Pbkdf2( salt , OldSha1Hash )

Background [Updated] Consider a situation where a website was created over a decade ago and user account password storage was done by storing SHA1(password) into ...
RonC's user avatar
  • 329
5 votes
1 answer
3k views

How long should the salt be for PBKDF2?

In order to complicate rainbow table attacks, salt must be provided as input to PBKDF2 when a key is derived from a low-entropy password. I have decided on my algorithms and key lengths to achieve ...
Konstantin Shemyak's user avatar
5 votes
1 answer
565 views

Is there a tangible benefit in keeping the number of PBKDF iterations secret and not storing them with the ciphertext?

Suppose I have a local file and it is encrypted with a symmetric key derived from a strong passphrase, unique salt and $x$ number of PBKDF (e.g. Scrypt) iterations. I am interested in keeping this ...
itercryp's user avatar

1
2 3 4 5 6