Questions tagged [pbkdf-2]

The Password-Based Key Derivation Function 2 (PBKDF2) is a method of securely deriving encryption keys from a passphrase entered by a user. It features an iteration count that can be deliberately adjusted (key stretching) to slow down brute force password guessing attacks.

Filter by
Sorted by
Tagged with
0
votes
1answer
3k views

Create key for AES-256 in Node.JS [closed]

I'm trying to create a strong key for encrypting some data using AES-256 for fun and practice. For my own practice, I want to make this as strong as possible, I don't care how long it takes to ...
2
votes
1answer
533 views

Is transporting a salt, IV, ciphertext and HMAC in an encrypted token an acceptable practice?

I’m porting over some crypto code from Mcrypt (deprecated) to OpenSSL. I’m following a process that a former employee implemented, which is as follows: Create a random salt for use in a PBKDF2 key ...
5
votes
1answer
671 views

Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?

PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
1
vote
1answer
602 views

Storing Salt in Ciphertext?

I found the cryptomator encryption documentation online, because I was looking for something to learn about x). I altered the process a bit to fit "my need" / so that I would not have a vault, but a ...
2
votes
2answers
193 views

Mechanism of PBKDF in encryption key generation with passphrase

I want to roughly understand how the mechanism works of generating an encryption key from a passphrase, by which we encrypt a volume or file. I'm familiar with public key encryption, the concept of a ...
2
votes
2answers
203 views

Multithreading PBKDF2 or javascript alternative

I'm using PBKDF2 in browser (can't use bcrypt, users are likely to have passwords > 72bytes, or whatever the number was). PBKDF2 is running in a webworker, something like so ...
-1
votes
2answers
267 views

Is HMAC a suitable substitute for HKDF?

My PHP version does not include the hash_hkdf() function, and upgrading versions is not worth the trouble for my project (which is for personal pleasure, not for ...
1
vote
4answers
1k views

I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error

People seem to mostly recommend scrypt these days, but I'm not sure if this should be the case? I'll structure this post by just making an argument for PBKDF2 over Scrypt and then you can reply ...
3
votes
4answers
297 views

How many bits of entropy are leaked for every derived password from a master?

Given a master password that has a lot of entropy (similar to Bitcoin HD wallet seed words, 130 bits of entropy or more) how many bits of entropy are lost per leaked generated password? Let's take an ...
3
votes
2answers
265 views

PBKDF2 with longer than native output length - Will hashing the result help?

I've seen it mentioned more than once that PBKDF2 should not be used to create a longer key than the native output (such as 160 bits when used with HMACSHA1). Since an attacker could test only the ...
2
votes
2answers
908 views

HMACSHA1 vs HMACSHA2 (for PBKDF2)

I need to choose an HMAC function for PBKDF2. I'm using .net so I don't have the option to use SHA3. At first glance, and according to this answer by Thomas Pornin it seems like SHA512 would be best....
2
votes
1answer
486 views

Web Crypto API - deriveKey vs. deriveBits? [closed]

I have some questions about deriveKey and deriveBits for web crypto API. I am confused about the state of these APIs. I do ...
2
votes
1answer
206 views

Does this PBKDF2-SHA1 payload hint at a cryptographic security issue?

Blockchain first 16 encrypted bytes, IV, and iter_count – all encoded in Base64: Yms6xqrzCfFsQadVZ5gQonMtnQAAAAAAAAAAAAAAAAAAAAAQJwAA69tYNg== Does it looks like “...
16
votes
2answers
2k views

Password hash that can be upgraded without plaintext password

Most password hashes have a cost parameter that indicates how long the algorithm should take. Is there an algorithm where you can increase that cost for a particular hash, without access to the ...
7
votes
1answer
512 views

Is it safe to store both the AES-related data and the PBKDF2-related data (except passwords) in one file?

Assume an "encrypted data package" file format which includes the following data PBKDF2 algorithm salt rounds keylen AES algorithm & mode IV ciphertext where the PBKDF2 salt and AES IV are ...
1
vote
2answers
501 views

Argon2id internal iterations vs multiple Argon2id calls ?

TLDR; Is there a security risk if rather than setting the iteration parameter to 12 (for example), we set it to 3 but call the function 4 times? I'm asking that for 2 reasons: Firstly, we use SRP ...
6
votes
1answer
10k views

Apple secure notes. How secure?

In terms of cryptography, how secure is Apple Secure Notes? Can one store sensitive information there? The relevant section of the Apple white paper is quoted below: The Notes app includes a Secure ...
4
votes
4answers
998 views

Rehashing PBKDF2 hashes - do iterations stack?

Let's suppose I have a bunch of PBKDF2 hashes in a database. For the sake of keeping this simple, let's say I've used 10 iterations. A few years later I decide to upgrade to 20 iterations. I want to ...
1
vote
2answers
206 views

KDF-based password manager

I want to make a password manager that from a single master password generates passwords for my services. For that I thought that HKDF suits my needs, as it is able to generate multiple keys from a ...
1
vote
1answer
908 views

HMAC vs PKDBF2 as the first step towards HKDF

I'm implementing an application that from a password has to derive two keys, one for authentication with the server, one for encryption. I'm using Java, with JCA and Bouncy Castle. So far, to ...
1
vote
1answer
180 views

How to generate two different keys out of a single password?

I'm designing a system in which a password is used both for logging in as well as for encrypting some payload. To encrypt a payload I derive a key from the password. Very straightforward so far. ...
4
votes
1answer
651 views

Some Questions about the Veracrypt hash functions

Veracrypt has always been my favourite encryption tool since it came out . But still there are some things about the tool I don't understand . Why is there the possibility to use sha256 or sha512 . ...
0
votes
1answer
2k views

Proper number of salt bytes for Rfc2898DeriveBytes/PBKDF2

I know that .NET's Rfc2898DeriveBytes requires at least 8 bytes of salt, but how many bytes are ideal? When a user is created, or changes their password, my server stores a new random salt for that ...
1
vote
1answer
1k views

What is meant by “KDF2” vs “PBKDF2”?

I see many references to KDF2 here, but all links are broken and Wikipedia does not have an entry for KDF2. Is KDF2 a specific standard for Key Derivation without a password? Ultimately, I am trying ...
3
votes
1answer
1k views

Can pbkdf2 be used with a fixed salt to give a deterministic slow hash?

I need a password hashing function that is deterministic. Correlation attacks are not a concern. The same password must produce the same hash. I just want to protect the password against dictionary ...
1
vote
1answer
99 views

Ensuring no unintended leaking before authentication

Assume my authentication system consists of querying an endpoint to get sign in parameters cost and salt, ...
1
vote
1answer
131 views

Do PBKDF2 keys generated at a lower iteration count leak information?

Assume the threat model here is that the server is not to be trusted and the client is trusted. A user registers for an account and the client chooses an iteration count of 50,000 to generate a 512 ...
0
votes
0answers
65 views

Authenticating PBKDF2 params from the server

In my app, I use PBKDF2 to stretch a user inputted password. I split the result in two: the first half is stored locally as an encryption key (and never sent to the server), and the second half is ...
1
vote
1answer
238 views

Generating HMAC-SHA256 - is this procedure secure enough?

I have 256-bit value (call it "{Secret Value}") and I would like to compute HMAC-SHA256 digest of this value to check its ...
1
vote
1answer
1k views

Must a key for a HMAC-SHA256 digest kept secure?

I need to check integrity of high secure system value - in this case encryption key(s) I would like to create HMAC digest of this user encryption key (key is used ...
6
votes
1answer
1k views

Argon2i versus Argon2d?

I am planning to use Argon2 in my Android app to encrypt some sensitive info that is only stored on the user's phone (in an SQLite DB) and not exported anywhere else. From documentation I see that ...
7
votes
1answer
1k views

Why does LastPass hash their passwords with PBKDF2 this way?

LastPass is a password manager that I am sure many of you are familiar with. I have been studying LastPass's source code a bit. From their FAQs and what I can gather from their source code, the way ...
6
votes
1answer
3k views

Is PBKDF2/RFC 2898 broken because SHA1 is broken?

I was attempting to re-implement the ASP.NET Identity password hash algorithm in PHP. It uses RFC 2898, which uses HMAC SHA1. SHA1 has been broken by google. Does this mean that RFC 2898 in general ...
3
votes
1answer
411 views

Is it a vulnerability (for message authentication) to have a variable iteration-count for PBKDF2?

The scenario: A user clicks on an encrypted file, and enters his password, in order to decrypt and authenticate it using HMAC (when its key is derived using PBKDF2). If the iteration-count is fixed, ...
1
vote
1answer
87 views

Is creating an authentication-key (mac) from the encryption password a vulnerability?

I can think of at least one problem with it - that testing for a correct key (when brute forcing) is simpler with a mac key (at least for short messages) and therefore can help brute force decryption.
1
vote
2answers
141 views

Can a attacker compute a hash from another hash of the same plaintext (both using different salt)?

Imagine two PBKDF2-SHA-512 hashes of the same password are generated. Each has individual salt. If an attacker had one hash and the salt of both hashes, would he be able to compute the missing hash or ...
1
vote
1answer
447 views

Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?

How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. ...
1
vote
1answer
614 views

Question about hashing passwords with PBKDF2

I am new here and new to encrypting and securing passwords, so please forgive me if this question is not posted to the right location or if my question is bad. I have been working on a web app in ...
5
votes
1answer
437 views

Upgrade password hash in an existing system: Pbkdf2( salt , OldSha1Hash )

Background [Updated] Consider a situation where a website was created over a decade ago and user account password storage was done by storing SHA1(password) into ...
2
votes
1answer
1k views

SHA-256 support for SecretKeyFactory in Java 6 and 7?

According to the following linked Java documentation, the relevant option for SecretKeyFactory algorithm (ignoring deprecated options involving MD5 or DES etc.) running in JRE 6 and JRE 7 is: ...
0
votes
1answer
95 views

Using simple hashing function to expand already secure key

Assume I only have only three algorithms available at my disposable: PBKDF2, SHA512, and HMAC-SHA256. (This means I do not have algorithms like HMAC-Expand available.) Assume I also have a ...
4
votes
1answer
239 views

Centralized storing of private RSA key

I working on multiuser project, where users can share data. The data that users upload to the server will be encrypted before it leaves the client with a symmetric cipher, and then the symmentric key ...
2
votes
1answer
53 views

How to provide encryption of user's data that can be performed by multiple (specific) users?

Let me explain my dilemma. I'm a software developer and I'm writing a Windows application that should provide encryption of user's data. There could be multiple users in the database, each having ...
1
vote
2answers
245 views

Key used by HMAC-SHAx in PBKDF2 [duplicate]

PBKDF2 can be used to derive a key from a passphrase, having in input the passphrase, the chosen number of iterations to slow down a brute force attack, a random salt and the chosen keylength. In its ...
6
votes
2answers
923 views

Can I use PBKDF2 as a stream cipher?

Unfortunately I have to implement some naive homemade symmetric crypto, since ordinary AES CTR is not implemented in available API on target platform. What I’m going to do is, given encryption ...
2
votes
1answer
343 views

PBKDF2 output size vs internal hashing algorithm

PBKDF2 allows you to choose an output size as well as the internal hashing function used. My question is, do these two sizes need to match? For example, if I'm using PBKDF2 with SHA512, does my ...
3
votes
0answers
637 views

Number of PBKDF2 iterations for modern computing devices [closed]

I know the question of "how many iterations should I use with PBKDF2" is asked quite often, and the answer is typically "test and see what's practical." However, my key derivation will be taking ...
2
votes
1answer
399 views

How to securely combine multiple sources of entropy?

Suppose that I have $n$ secure 32-bit keys that were generated separately using methods that are known to be secure. For example, one of them might have been generated by using a proven CSPRNG. ...
5
votes
3answers
1k views

Derive a key from a password and another key?

I would like to encrypt some data using a password. I want to use a function like PBKDF2 to turn my password into a key. However, I would like to also require a keyfile, for added security. My data ...
0
votes
1answer
292 views

Number of words to be outputted from PBKDF2 based on HMAC-SHA512?

I'm using PBKDF2 to generate a 512 bit key. My question is language agnostic, but for the sake of demonstration, I'm using CryptoJS, which defaults to using SHA1, but can be overridden like so: ...