Questions tagged [pbkdf-2]

The Password-Based Key Derivation Function 2 (PBKDF2) is a method of securely deriving encryption keys from a passphrase entered by a user. It features an iteration count that can be deliberately adjusted (key stretching) to slow down brute force password guessing attacks.

Filter by
Sorted by
Tagged with
11
votes
3answers
2k views

Is deriving the IV from the password secure?

I came across an encryption scheme to encrypt files with AES-256. You can see the initialization of the decryption routine below: ...
1
vote
1answer
2k views

Increased AES key lengths vs keyphrase entropy

I'm selecting an AES key size for a LUKS partition using XTS-PLAIN64. XTS will effectively reduce the AES key strength in half. The default key size for AES XTS-PLAIN64 is 256 bits (meaning 128 bits ...
3
votes
1answer
777 views

What is the difference between KDFs for key derivation vs password stretching?

This was mentioned in the comments to another question: To clarify: This is about key-stretching KDFs. Not the kind for diversifying keys (eg. HKDF) and There are two kinds of KDF, the slow, ...
2
votes
1answer
260 views

Is there any use for PBKDF with empty password?

As the name suggests, password based key derivation functions are used for deriving a cryptographic key from, well, a password. Is there any use for PBKDFs with empty password? Does it give any ...
5
votes
1answer
2k views

How long should the salt be for PBKDF2?

In order to complicate rainbow table attacks, salt must be provided as input to PBKDF2 when a key is derived from a low-entropy password. I have decided on my algorithms and key lengths to achieve ...
1
vote
0answers
128 views

Authentication of short message based on 6-digit alphanumeric compare-and-confirm

I have two parties that want to communicate with each other based on a shared password. The protocol is using PBKDF2 (with HMAC-SHA256) to create a shared key on both sides (due to restrictions on the ...
2
votes
2answers
189 views

Any advantage of multiple salts/keys for single password when using PBKDF for multiple secrets?

Background: I'm putting together a personal project to store multiple short message protected by a master password. This is more to learn and demonstrate that I understand how to use some standard ...
0
votes
1answer
1k views

Encrypt without password, decrypt only with password

I'm trying to implement a password manager and I want to achieve this behaviour. User enters a master password once (eg. when the program is first run) and a key/hash of some sort is derived and ...
1
vote
1answer
2k views

WPA/WPA2 Handshake — Why are Nonces not encrypted?

During the WPA/WPA2 handshake, the client and AP compute a 256-bit Pre-shared Master Key (PMK) before exchanging Nonces that are used to compute the eventual key. Given that the hosts already have a ...
2
votes
1answer
3k views

Generating passwords using Password-Based Key Derivation Function

I was thinking of using different and independent password for different websites, but not storing them in some password manager so I don't need to backup the passwords. I thought I could use some ...
4
votes
1answer
246 views

Encrypt a small amount of data with a password derived from PBKDF2

I have a small amount of data (about 128 bits) to secured with a strong password. I plan to run PBKDF2-SHA2-256 on the password and a 128 bit random salt to generate a 256 bit derived key. Then with ...
1
vote
1answer
1k views

PBKDF2 without salt on 16 digit password

How secure would be to use PBKDF2 without salt (or with the same salt for all) with a 16 digits passwords that are unique and randomly generated (there can't be two identical)? Assuming an adversary ...
0
votes
0answers
524 views

Secure algorithm for calculating token and comparison

I am trying to define algorithm that would create a irreversible token from IDs, which are 10 digit information, and then would be compared on two different end points. Between end points, only ...
0
votes
1answer
274 views

PBKDF2 with the same salt for all IDs

I have a unique identifiers that I would like to keep secure and provide information about it through tokens. These tokens should be verifiable after using the same algorithm on other end system with ...
3
votes
1answer
433 views

Rotating password with PBKDF2

Crypto is hard. Thank you for helping me learn. My encryption scheme currently looks like this: Salt is stored out in the open Secret is the user's password, known only to them EncKey||AuthKey = ...
8
votes
2answers
8k views

What are KDF parameters in OpenSSL command-line utility for `enc`?

I refer to https://www.openssl.org/docs/manmaster/apps/enc.html and see that the only parameter for key derivation which I can set explicitly (not considering the obvious ...
2
votes
0answers
119 views

Combining AES-SIV and a password-derived key

I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$: $$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$ where $AAD$ is a string of 48 bytes, of which 21 bytes are a random ...
5
votes
1answer
2k views

PBKDF2 PRF: HMAC or just hash?

I understand the way $\textrm{PBKDF2}$ can be used to 'stretch' a password/passphrase that does not provide full entropy. My question: how does one choose the PRF? A common choice is any well-known ...
2
votes
3answers
465 views

Can an adversary distinguish a private key from a pseudo-random string of the same length?

Apologies if this is a dumb question but allow me to describe the dilemma I have: Suppose that I am protecting a private key on a device using a password & PBKDF2. The obvious attack would be an ...
11
votes
1answer
1k views

Does a big salt have the same memory effects as Bcrypt?

Citing Thomas Pornin on the question Why can't one implement bcrypt in Cuda?: bcrypt is a variant of the Blowfish key scheduling, which is defined over a table (a few kilobytes) which is constantly ...
2
votes
1answer
890 views

AES GCM encryption, authentication and PBKDF2

I'm developing a kind of secret vault server application. The basic principle is similar to DPAPI where each secret will have its own unique random KEY/IV pair and and that KEY/IV pair will be ...
12
votes
2answers
22k views

What's the difference between PBKDF and SHA and why use them together?

I've been reading a little bit about hashing lately and according to AgileBits, they use "SHA512 within PBKDF2" in their new vault file. I've looked in Wikipedia for both names and I know PBKDF2 is a ...
3
votes
1answer
1k views

Deriving AES key and HMAC key from shorter master key

I am working in .NET and as far as I can tell the only choice for key derivation is PBKDF2-HMAC-SHA1. SHA1's output size is only 160 bits. But I am implementing authenticated encryption and thus ...
2
votes
1answer
724 views

Deriving 256-bit key from PBKDF2-SHA1

I am working in .NET and their PBKDF2 only uses SHA-1. I am using it to, given a user-supplied password and random salt, generate a 256-bit AES key. The plaintext is encrypted with the AES key and ...
3
votes
1answer
132 views

Security implication of deriving key with fixed salt for files authentication

Context: I need to calculate MAC for a collection of files just for future integrity and authentication verification. This is the conceptual order of steps: Derive a 64 bytes key from user input ...
1
vote
1answer
121 views

Is it safe to use a key as message in keyed hashing (HMAC)?

Scenario: User gives password. A "password key" is derived from the password (e.g. by PBKDF2). A random salt is applied. The password key is hashed with a HMAC algorithm (e.g. HMAC-SHA256), with ...
4
votes
1answer
1k views

Understanding WPA2 authentication in details

As far as I know, WPA2 authentication consists of a 4-way handshake. The first message is from the AP, containing the ANounce, a random number generated by the AP, The second message is from the ...
3
votes
1answer
744 views

Deriving a key for HMAC, using PBKDF2

What is the recommended way to derive a key for an HMAC-SHA256, from a passphrase and salt? I'd like to compute an HMAC-SHA256. I have a passphrase, and a message. I note that RFC-7518 (JWA) ...
3
votes
1answer
169 views

How to change the master password in a password manager

For a personal project, I'm building a password manager, based off the project in this syllabus from Stanford http://crypto.stanford.edu/~dabo/cs255/hw_and_proj/proj1.pdf Since I don't exactly have ...
1
vote
0answers
186 views

What is the 'identity function' in AES?

I'm trying to understand how AES works. I got as far as knowing how a password is converted to an unifinished key with the PBKDF2 function. After that RFC3962 says that an AES useable key most be ...
0
votes
2answers
351 views

The benefit of PBKDF2 for big keyfile?

The man page of cryptsetup says: Whenever a passphrase is added to a LUKS header (luksAddKey, luksFormat), the user may specify how much the time the passphrase processing should consume. The ...
6
votes
1answer
143 views

Are shorter password hashes safe?

How much can I shorten a password hash before it begins to impact security? Suppose that I use PBKDF2 (correctly salted) with HMAC-SHA256 as the PRF. From what I've seen, it's typical to use 256 ...
3
votes
1answer
196 views

Attacks on WinRAR volumes reusing same password?

I have quite a few WinRAR volumes that are all encrypted with the same password. The password is long and unbruteforceable, but I recently read that WinRAR uses PBDKF2 as its key-derivation function ...
3
votes
1answer
727 views

Is this a proper PBKDF2 key derivation function algorithm?

I've started implementing PBKDF2 algorithm recently and since I'm new in crypto, I would like to ask if my implementation is good. I looked up some documentations and I tried to follow many of them ...
3
votes
2answers
149 views

Public SRP verifiers or public hash chain “public keys” when secret is low entropy password

I want to set up the following: An untrusted server should host user sessions and authenticate users without knowing their passwords or being capable of creating a fake user session in the user's ...
1
vote
0answers
132 views

Hardening of random number generators

Boxcryptor uses various CSPRNGs and apparently hashes the output using PBKDF2 to derive the final key. Even though the choice of ...
5
votes
1answer
275 views

Is there a tangible benefit in keeping the number of PBKDF iterations secret and not storing them with the ciphertext?

Suppose I have a local file and it is encrypted with a symmetric key derived from a strong passphrase, unique salt and $x$ number of PBKDF (e.g. Scrypt) iterations. I am interested in keeping this ...
1
vote
1answer
81 views

Using similar passwords and salts for PBKDF2

I'm trying to generate a bunch of pseudo-random keys for AES using PBKDF2, where the AES ciphers will be used in CTR mode as pseudo-random number generators. My goal is to create a 2-dimensional array,...
1
vote
0answers
64 views

Security of simple Skein PBKDF mentioned in the paper

From the Skein 1.3 paper section 4.8, Skein as a Password-Based Key Derivation Function (PBKDF), it mentions the following as a simple PBKDF (S = seed and P = password): An even simpler PBKDF is to ...
3
votes
2answers
1k views

Replacing the PRF in PBKDF2 with Keccak

I am unable to find a reliable, tested library for a decent password based key derivation function e.g. Scrypt in the programming language I am using, but I have a reliable library for PBKDF2 (which ...
2
votes
1answer
1k views

PBKDF2 for login key, scrypt for encryption key

I need to derive two keys from a single password client side. One for in-browser login, the other for encryption. Is the following secure ? ...
2
votes
2answers
1k views

Generate secure password hashes without access to PBKDF2 or bcrypt

Given is a system, which does provide only implementations of fast hash algorithms (MD5, SHA1, SHA-256, SHA-512). There is no implementation of PBKDF2, bcrypt or scrypt available. The system does ...
1
vote
1answer
176 views

Adding a Password Hash (key derivation) function to existing password storage solution

As always we are trying to improve password storage; before just adding new ways of storing our password we need to define what threats we will mitigate by adding in a new way to store our password. ...
3
votes
2answers
2k views

Using bcrypt derived keys for encryption?

Sorry for this ignorant question but I am currently weighing up the advantages and disadvantages of BCrypt over PBKDF2 and from what I have read BCrypt is considered more secure but from what I have ...
2
votes
1answer
490 views

Storing salts and iteration number?

I have a function that derives two sub-keys from one passphrase using PBKDF2 one which is used as a encryption key the other for HMAC generation, because these two sub-keys will need to be regenerated ...
1
vote
2answers
1k views

Does google's Crypto.JS AES encryption use PBKDF2 as default?

Does google's Crypto.JS AES encryption use PBKDF2 as default? Some references, but I can't figure out the answer myself: https://code.google.com/p/crypto-js/#The_Cipher_Algorithms https://code....
0
votes
2answers
930 views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
1
vote
1answer
468 views

INT_32_BE in PBKDF2

Trying to understand PBKDF2 in detail. It is clear that the password and the salt is given to the PRF (which is HMAC-SHA-1 in the specification). But what is the role of the INT_32_BE(i)? What does it ...
2
votes
3answers
1k views

Implementing a web app where the server cannot decrypt its own data? [closed]

I'm a cryptography novice, but I think that the world needs to move towards an "encrypt everything" mentality as much as possible. As a result, I've been thinking a lot about ways to build a web app ...
2
votes
1answer
826 views

Strong key generation using PBKDF

I know that PBKDF2 is very useful for generating strong keys. I'm trying to know is there any additional contribution of the given password to produce even stronger keys. Which key is more secure: ...