Questions tagged [pbkdf-2]

The Password-Based Key Derivation Function 2 (PBKDF2) is a method of securely deriving encryption keys from a passphrase entered by a user. It features an iteration count that can be deliberately adjusted (key stretching) to slow down brute force password guessing attacks.

Filter by
Sorted by
Tagged with
2 votes
1 answer
496 views

Is there a test that put into numbers how secure a password hashing is?

As the question puts it: is there a test that can be done or a software that can be used, that is able to provide numbers/data to prove how secure a password hashing is? Say for example that I want to ...
Learning Bakpao's user avatar
2 votes
1 answer
2k views

Storing Salt in Ciphertext?

I found the cryptomator encryption documentation online, because I was looking for something to learn about x). I altered the process a bit to fit "my need" / so that I would not have a vault, but a ...
Franz's user avatar
  • 23
2 votes
1 answer
504 views

Is there any use for PBKDF with empty password?

As the name suggests, password based key derivation functions are used for deriving a cryptographic key from, well, a password. Is there any use for PBKDFs with empty password? Does it give any ...
buc's user avatar
  • 123
2 votes
2 answers
244 views

Any advantage of multiple salts/keys for single password when using PBKDF for multiple secrets?

Background: I'm putting together a personal project to store multiple short message protected by a master password. This is more to learn and demonstrate that I understand how to use some standard ...
Neil Slater's user avatar
  • 1,119
2 votes
1 answer
1k views

Right usage of PBKDF2 and login system questions

I'm developing the login part of my application and I was asking myself how to do it right. My application stores some users' data server-side that must be inaccessible from us, so all the content ...
user12399's user avatar
2 votes
0 answers
119 views

Content Key Encryption for Multi-User data access

I recently worked out a concept for a use-case, but I'm not sure if my approach is good enough. So I would appreciate feedback and things to look out for, as I'm fairly new to this field. A User can ...
MultiUserDude's user avatar
2 votes
1 answer
283 views

Are there cryptographical flaws in this e2ee website chat widget? [closed]

For a product I'm developing I want to verify if the thinking behind it is cryptographically strong and secure. The product is a chat widget on websites of customers. Like an e2ee version of Intercom. ...
adriaan's user avatar
  • 121
2 votes
0 answers
188 views

Combining AES-SIV and a password-derived key

I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$: $$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$ where $AAD$ is a string of 48 bytes, of which 21 bytes are a random ...
DiscobarMolokai's user avatar
2 votes
1 answer
497 views

User-specified PBKDF2 password, salt, and iterations limits

For a decentralized login where a user is left to select the password, salt, and iterations, what minimums for each should be enforced? In other words, because none are ever stored by the ...
user avatar
1 vote
4 answers
2k views

I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error

People seem to mostly recommend scrypt these days, but I'm not sure if this should be the case? I'll structure this post by just making an argument for PBKDF2 over Scrypt and then you can reply ...
John Smith's user avatar
1 vote
1 answer
3k views

WPA/WPA2 Handshake -- Why are Nonces not encrypted?

During the WPA/WPA2 handshake, the client and AP compute a 256-bit Pre-shared Master Key (PMK) before exchanging Nonces that are used to compute the eventual key. Given that the hosts already have a ...
Minaj's user avatar
  • 1,080
1 vote
2 answers
241 views

How much computation it takes to crack a PBKDF2's secret salt when the passphrase meterial has been leaked

Given the following code, extracted from a Bip39 implementation for Android by Zcash ...
zjmo's user avatar
  • 123
1 vote
1 answer
1k views

Best hash for PBKDF2?

I have a my own PBKDF2 automated implementation that automatically salts the hash. The output looks like this: ...
Engo's user avatar
  • 11
1 vote
2 answers
414 views

KDF-based password manager

I want to make a password manager that from a single master password generates passwords for my services. For that I thought that HKDF suits my needs, as it is able to generate multiple keys from a ...
lmureu's user avatar
  • 13
1 vote
1 answer
2k views

Is AES GCM with PBKDF2 100k iterations still ok as of 2022?

Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022? In our threat model, if we ignore the risks linked to quantum computing, is this secure? Here is an example ...
Basj's user avatar
  • 553
1 vote
2 answers
93 views

Is it reasonable to use DRBG and PBKDF together?

I want to generate a random number using DRBG with below follow: Entropy source -> DRBG -> PBKDF adding PBKDF is redundant ?
Andy's user avatar
  • 71
1 vote
2 answers
354 views

Static salt for PBKDF2, but unique salt for HKDF?

Hypothetical. Lets say you have an application where you generate a master key from a user password using PBKDF2 (static salt) and then use the master key to derive two passwords keys for an encrypt-...
Chris_F's user avatar
  • 197
1 vote
1 answer
2k views

Why use PBKDF2 over SHA-512 to derive AES encryption key? [duplicate]

Suppose I am using user passwords to derive AES-128-CBC encryption key. This key will be used to encrypt some sensitive data for the user so that even the website owner / operator can not decrypt it. ...
mark820850's user avatar
1 vote
2 answers
2k views

Should number of iterations of PBKDF2 stay secret?

Let's say I encrypt my passwords with PBKDF2 and store it somewhere. Now let's say it was stolen and the hacker, who stole it knows it was hashed with PBKDF2. Does a knowledge of number of iterations ...
mafonya's user avatar
  • 165
1 vote
1 answer
2k views

What is meant by "KDF2" vs "PBKDF2"?

I see many references to KDF2 here, but all links are broken and Wikipedia does not have an entry for KDF2. Is KDF2 a specific standard for Key Derivation without a password? Ultimately, I am trying ...
Jonathan Cross's user avatar
1 vote
1 answer
166 views

Do PBKDF2 keys generated at a lower iteration count leak information?

Assume the threat model here is that the server is not to be trusted and the client is trusted. A user registers for an account and the client chooses an iteration count of 50,000 to generate a 512 ...
Snowman's user avatar
  • 363
1 vote
2 answers
259 views

Key used by HMAC-SHAx in PBKDF2 [duplicate]

PBKDF2 can be used to derive a key from a passphrase, having in input the passphrase, the chosen number of iterations to slow down a brute force attack, a random salt and the chosen keylength. In its ...
M-elman's user avatar
  • 1,248
1 vote
2 answers
2k views

Does google's Crypto.JS AES encryption use PBKDF2 as default?

Does google's Crypto.JS AES encryption use PBKDF2 as default? Some references, but I can't figure out the answer myself: https://code.google.com/p/crypto-js/#The_Cipher_Algorithms https://code....
pinhead's user avatar
  • 245
1 vote
1 answer
292 views

symmetric key generation - random number vs pbkdf2

I am working on improving my grasp on applied cryptography. Following question is just for learning/understanding purposes.. Lets say I want to generate a 16 byte key that I want to use for some ...
Manohar's user avatar
  • 155
1 vote
1 answer
1k views

How long does it take to decrypt AES encrypted message with salt(for pbkdf2 key) and iv known

I'm new to crypto! The situation is, Aes-256-cbc encrypted message(including not encrypted iv & salt) is revealed. We also know pbkdf2 function uses 10000 rounds with sha256. All we need to ...
Hyunhum's user avatar
  • 11
1 vote
1 answer
874 views

Salt value in scrypt algorithm

I see there are a lot of questions relating to handling of a salt value but nothing I have seen so far has cleared the following question. When using a KDF such a scrypt, I believe the value of the ...
cjd's user avatar
  • 55
1 vote
2 answers
861 views

Safest alternative for hashing credit card numbers to use the hash as fingerprint?

Same question asked here in 2014 but since a lot has changed since then, I would like to get feedback from experts on the latest best practices. The problem Our requirement is to provide the ...
KurtWegner's user avatar
1 vote
1 answer
143 views

can I use PBKDF2 instead of hmac as a hashing tool for sensitive data

I have read about hmac and PBKDF2. PBKDF2 - is mainly used for password hashing. It uses ...
Santhosh's user avatar
  • 113
1 vote
1 answer
2k views

Argon2 or scrypt instead of PBKDF2 with AES

Is using scrypt or argon2 a better key stretching technique with AES compared to PBKDF2 or bcrypt with regards to a quantum computer brute force attack. The brute force attack I'm referring to is ...
Thunder's user avatar
  • 111
1 vote
1 answer
303 views

How to make my hash more robust to the brute force?

I'm using PBKDF2 SHA 256 with 100 000 iterations to generate a secret. I want to increase the cost of brute forcing the passphrase I use to generate the secret. I'm thinking of using scrypt after ...
Guillaume Vincent's user avatar
1 vote
1 answer
219 views

Does having an SHA256 hash compromise PBKDF2 secrecy?

If I have a password pwd, and I hash it with SHA256 and send it to a server for authentication (server will apply ...
Potassium Ion's user avatar
1 vote
1 answer
1k views

HMAC vs PKDBF2 as the first step towards HKDF

I'm implementing an application that from a password has to derive two keys, one for authentication with the server, one for encryption. I'm using Java, with JCA and Bouncy Castle. So far, to ...
Pablo Fernandez's user avatar
1 vote
1 answer
2k views

Must a key for a HMAC-SHA256 digest kept secure?

I need to check integrity of high secure system value - in this case encryption key(s) I would like to create HMAC digest of this user encryption key (key is used ...
jnemecz's user avatar
  • 155
1 vote
1 answer
675 views

INT_32_BE in PBKDF2

Trying to understand PBKDF2 in detail. It is clear that the password and the salt is given to the PRF (which is HMAC-SHA-1 in the specification). But what is the role of the INT_32_BE(i)? What does it ...
Giliweed's user avatar
  • 597
1 vote
2 answers
2k views

pbkdf2 password validation

My question is related to PBKDF2. I am unsure how to validate user entered password with already existing hashes and salts. I have heard of the so called "length-constant" comparison which basically ...
SuperUser's user avatar
1 vote
2 answers
246 views

Hashes to passwords with PBKDF2

If an attacker wants to hack the passwords of $2^{10}$ users. And all of these users generate a password from the space of $2^{50}$ passwords** and each password is hashed with PBKDF2 with $2^{10}$ ...
CryptoGuru's user avatar
1 vote
1 answer
378 views

To what degree does a high PKBDF-HMAC-SHA1 iteration count compensate for a weak passphrase entropy?

Lost a LUKS-encrypted laptop at the end of 2019 and now trying to figure out the odds of a very sophisticated attacker being able to break in. The LUKS container was created mid-2017 with LUKS1 ...
Peter_Python's user avatar
1 vote
1 answer
73 views

Issue with decrypting self-coded AES

Summary: As a trainee, I got the task to extract encrypted passwords of our external password manager (Zoho Vault) and decrypt them. The documentation regarding how to decrpyt them is...none. I ask ...
Merz's user avatar
  • 11
1 vote
1 answer
1k views

AES PKCS5 Padding when it's not needed

I'm using AES/ECB with PKCS5 Padding (From what I've read, PKCS7 Padding is actually used internally) and PBKDF2(HMAC-SHA256) to encrypt some passwords in Java. I enter a password, that goes through ...
Siguantu's user avatar
1 vote
1 answer
547 views

Can you derive a 128 bit AES encryption key using PBKDF2 with SHA-256

I got confused about key derivation functions. For my project, I need to derive a 128 bits AES encryption key in CTR mode. To do so, I'm using a PBKDF2 to derive this encryption key using an initial ...
Ahmet Eroğlu's user avatar
1 vote
1 answer
287 views

Generating HMAC-SHA256 - is this procedure secure enough?

I have 256-bit value (call it "{Secret Value}") and I would like to compute HMAC-SHA256 digest of this value to check its ...
jnemecz's user avatar
  • 155
1 vote
1 answer
90 views

Is creating an authentication-key (mac) from the encryption password a vulnerability?

I can think of at least one problem with it - that testing for a correct key (when brute forcing) is simpler with a mac key (at least for short messages) and therefore can help brute force decryption.
ispiro's user avatar
  • 2,005
1 vote
1 answer
1k views

Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?

How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. ...
dt_slash's user avatar
  • 105
1 vote
1 answer
3k views

Increased AES key lengths vs keyphrase entropy

I'm selecting an AES key size for a LUKS partition using XTS-PLAIN64. XTS will effectively reduce the AES key strength in half. The default key size for AES XTS-PLAIN64 is 256 bits (meaning 128 bits ...
Tom Hale's user avatar
  • 153
1 vote
1 answer
93 views

Using similar passwords and salts for PBKDF2

I'm trying to generate a bunch of pseudo-random keys for AES using PBKDF2, where the AES ciphers will be used in CTR mode as pseudo-random number generators. My goal is to create a 2-dimensional array,...
brianmearns's user avatar
1 vote
1 answer
198 views

Adding a Password Hash (key derivation) function to existing password storage solution

As always we are trying to improve password storage; before just adding new ways of storing our password we need to define what threats we will mitigate by adding in a new way to store our password. ...
Darragh's user avatar
  • 11
1 vote
1 answer
2k views

Importance of salt when deriving an encryption key

I'm very curious to know this and a bit confuses too: Suppose, I have two files encrypted using AES-128bit with keys PBKDF2-derived from the same password and the same salt. If an attacker does brute ...
Giliweed's user avatar
  • 597
1 vote
1 answer
2k views

Encrypting a payload for transmission over HTTP. AES256 with PBKDF2

I've done some reading about implementing AES256 and deriving a key from a password. If I understand correctly: I want to generate a new salt (for the key) and a new IV (for the encrypted message) ...
ndsc's user avatar
  • 111
1 vote
1 answer
518 views

PBKDF2 when dkLen and hLen have the same size

I was reading RFC 2898 and something is not clear to me. When I use PBKDF2 with SHA-256 and I want a derived key with length 32 bytes (the same length as my hash function output), your derived key ...
Anonymous's user avatar
  • 431
1 vote
2 answers
56 views

Does having a known suffix on the input to PBKDF2 make you more vulnerable?

I have an implementation of PBKDF2, which I know Has two bytes of '=' at the end of the input Has an input length of 24 (which is a Base64 encoded character representation of 16 bytes of entropy) ...
Evan Carroll's user avatar