Questions tagged [pbkdf-2]
The Password-Based Key Derivation Function 2 (PBKDF2) is a method of securely deriving encryption keys from a passphrase entered by a user. It features an iteration count that can be deliberately adjusted (key stretching) to slow down brute force password guessing attacks.
255
questions
2
votes
1
answer
496
views
Is there a test that put into numbers how secure a password hashing is?
As the question puts it: is there a test that can be done or a software that can be used, that is able to provide numbers/data to prove how secure a password hashing is? Say for example that I want to ...
2
votes
1
answer
2k
views
Storing Salt in Ciphertext?
I found the cryptomator encryption documentation online, because I was looking for something to learn about x). I altered the process a bit to fit "my need" / so that I would not have a vault, but a ...
2
votes
1
answer
504
views
Is there any use for PBKDF with empty password?
As the name suggests, password based key derivation functions are used for deriving a cryptographic key from, well, a password.
Is there any use for PBKDFs with empty password? Does it give any ...
2
votes
2
answers
244
views
Any advantage of multiple salts/keys for single password when using PBKDF for multiple secrets?
Background: I'm putting together a personal project to store multiple short message protected by a master password. This is more to learn and demonstrate that I understand how to use some standard ...
2
votes
1
answer
1k
views
Right usage of PBKDF2 and login system questions
I'm developing the login part of my application and I was asking myself how to do it right. My application stores some users' data server-side that must be inaccessible from us, so all the content ...
2
votes
0
answers
119
views
Content Key Encryption for Multi-User data access
I recently worked out a concept for a use-case, but I'm not sure if my approach is good enough.
So I would appreciate feedback and things to look out for, as I'm fairly new to this field.
A User can ...
2
votes
1
answer
283
views
Are there cryptographical flaws in this e2ee website chat widget? [closed]
For a product I'm developing I want to verify if the thinking behind it is cryptographically strong and secure. The product is a chat widget on websites of customers. Like an e2ee version of Intercom.
...
2
votes
0
answers
188
views
Combining AES-SIV and a password-derived key
I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$:
$$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$
where
$AAD$ is a string of 48 bytes, of which 21 bytes are a random ...
2
votes
1
answer
497
views
User-specified PBKDF2 password, salt, and iterations limits
For a decentralized login where a user is left to select the password, salt, and iterations, what minimums for each should be enforced?
In other words, because none are ever stored by the ...
1
vote
4
answers
2k
views
I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error
People seem to mostly recommend scrypt these days, but I'm not sure if this should be the case? I'll structure this post by just making an argument for PBKDF2 over Scrypt and then you can reply ...
1
vote
1
answer
3k
views
WPA/WPA2 Handshake -- Why are Nonces not encrypted?
During the WPA/WPA2 handshake, the client and AP compute a 256-bit Pre-shared Master Key (PMK) before exchanging Nonces that are used to compute the eventual key. Given that the hosts already have a ...
1
vote
2
answers
241
views
How much computation it takes to crack a PBKDF2's secret salt when the passphrase meterial has been leaked
Given the following code, extracted from a Bip39 implementation for Android by Zcash
...
1
vote
1
answer
1k
views
Best hash for PBKDF2?
I have a my own PBKDF2 automated implementation that automatically salts the hash. The output looks like this:
...
1
vote
2
answers
414
views
KDF-based password manager
I want to make a password manager that from a single master password generates passwords for my services. For that I thought that HKDF suits my needs, as it is able to generate multiple keys from a ...
1
vote
1
answer
2k
views
Is AES GCM with PBKDF2 100k iterations still ok as of 2022?
Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022?
In our threat model, if we ignore the risks linked to quantum computing, is this secure?
Here is an example ...
1
vote
2
answers
93
views
Is it reasonable to use DRBG and PBKDF together?
I want to generate a random number using DRBG with below follow:
Entropy source -> DRBG -> PBKDF
adding PBKDF is redundant ?
1
vote
2
answers
354
views
Static salt for PBKDF2, but unique salt for HKDF?
Hypothetical. Lets say you have an application where you generate a master key from a user password using PBKDF2 (static salt) and then use the master key to derive two passwords keys for an encrypt-...
1
vote
1
answer
2k
views
Why use PBKDF2 over SHA-512 to derive AES encryption key? [duplicate]
Suppose I am using user passwords to derive AES-128-CBC encryption key. This key will be used to encrypt some sensitive data for the user so that even the website owner / operator can not decrypt it.
...
1
vote
2
answers
2k
views
Should number of iterations of PBKDF2 stay secret?
Let's say I encrypt my passwords with PBKDF2 and store it somewhere. Now let's say it was stolen and the hacker, who stole it knows it was hashed with PBKDF2.
Does a knowledge of number of iterations ...
1
vote
1
answer
2k
views
What is meant by "KDF2" vs "PBKDF2"?
I see many references to KDF2 here, but all links are broken and Wikipedia does not have an entry for KDF2. Is KDF2 a specific standard for Key Derivation without a password?
Ultimately, I am trying ...
1
vote
1
answer
166
views
Do PBKDF2 keys generated at a lower iteration count leak information?
Assume the threat model here is that the server is not to be trusted and the client is trusted. A user registers for an account and the client chooses an iteration count of 50,000 to generate a 512 ...
1
vote
2
answers
259
views
Key used by HMAC-SHAx in PBKDF2 [duplicate]
PBKDF2 can be used to derive a key from a passphrase, having in input the passphrase, the chosen number of iterations to slow down a brute force attack, a random salt and the chosen keylength. In its ...
1
vote
2
answers
2k
views
Does google's Crypto.JS AES encryption use PBKDF2 as default?
Does google's Crypto.JS AES encryption use PBKDF2 as default?
Some references, but I can't figure out the answer myself:
https://code.google.com/p/crypto-js/#The_Cipher_Algorithms
https://code....
1
vote
1
answer
292
views
symmetric key generation - random number vs pbkdf2
I am working on improving my grasp on applied cryptography. Following question is just for learning/understanding purposes..
Lets say I want to generate a 16 byte key that I want to use for some ...
1
vote
1
answer
1k
views
How long does it take to decrypt AES encrypted message with salt(for pbkdf2 key) and iv known
I'm new to crypto!
The situation is,
Aes-256-cbc encrypted message(including not encrypted iv & salt) is revealed.
We also know pbkdf2 function uses 10000 rounds with sha256.
All we need to ...
1
vote
1
answer
874
views
Salt value in scrypt algorithm
I see there are a lot of questions relating to handling of a salt value but nothing I have seen so far has cleared the following question.
When using a KDF such a scrypt, I believe the value of the ...
1
vote
2
answers
861
views
Safest alternative for hashing credit card numbers to use the hash as fingerprint?
Same question asked here in 2014 but since a lot has changed since then, I would like to get feedback from experts on the latest best practices.
The problem
Our requirement is to provide the ...
1
vote
1
answer
143
views
can I use PBKDF2 instead of hmac as a hashing tool for sensitive data
I have read about hmac and PBKDF2.
PBKDF2 - is mainly used for password hashing. It uses ...
1
vote
1
answer
2k
views
Argon2 or scrypt instead of PBKDF2 with AES
Is using scrypt or argon2 a better key stretching technique with AES compared to PBKDF2 or bcrypt with regards to
a quantum computer brute force attack. The brute force attack I'm referring to is ...
1
vote
1
answer
303
views
How to make my hash more robust to the brute force?
I'm using PBKDF2 SHA 256 with 100 000 iterations to generate a secret.
I want to increase the cost of brute forcing the passphrase I use to generate the secret.
I'm thinking of using scrypt after ...
1
vote
1
answer
219
views
Does having an SHA256 hash compromise PBKDF2 secrecy?
If I have a password pwd, and I hash it with SHA256 and send it to a server for authentication (server will apply ...
1
vote
1
answer
1k
views
HMAC vs PKDBF2 as the first step towards HKDF
I'm implementing an application that from a password has to derive two keys, one for authentication with the server, one for encryption. I'm using Java, with JCA and Bouncy Castle.
So far, to ...
1
vote
1
answer
2k
views
Must a key for a HMAC-SHA256 digest kept secure?
I need to check integrity of high secure system value - in this case encryption key(s)
I would like to create HMAC digest of this user encryption key (key is used ...
1
vote
1
answer
675
views
INT_32_BE in PBKDF2
Trying to understand PBKDF2 in detail. It is clear that the password and the salt is given to the PRF (which is HMAC-SHA-1 in the specification). But what is the role of the INT_32_BE(i)? What does it ...
1
vote
2
answers
2k
views
pbkdf2 password validation
My question is related to PBKDF2. I am unsure how to validate user entered password with already existing hashes and salts.
I have heard of the so called "length-constant" comparison which basically ...
1
vote
2
answers
246
views
Hashes to passwords with PBKDF2
If an attacker wants to hack the passwords of $2^{10}$ users. And all of these users generate a password from the space of $2^{50}$ passwords** and each password is hashed with PBKDF2 with $2^{10}$ ...
1
vote
1
answer
378
views
To what degree does a high PKBDF-HMAC-SHA1 iteration count compensate for a weak passphrase entropy?
Lost a LUKS-encrypted laptop at the end of 2019 and now trying to figure out the odds of a very sophisticated attacker being able to break in.
The LUKS container was created mid-2017 with LUKS1 ...
1
vote
1
answer
73
views
Issue with decrypting self-coded AES
Summary: As a trainee, I got the task to extract encrypted passwords of our external password manager (Zoho Vault) and decrypt them. The documentation regarding how to decrpyt them is...none. I ask ...
1
vote
1
answer
1k
views
AES PKCS5 Padding when it's not needed
I'm using AES/ECB with PKCS5 Padding (From what I've read, PKCS7 Padding is actually used internally) and PBKDF2(HMAC-SHA256) to encrypt some passwords in Java. I enter a password, that goes through ...
1
vote
1
answer
547
views
Can you derive a 128 bit AES encryption key using PBKDF2 with SHA-256
I got confused about key derivation functions. For my project, I need to derive a 128 bits AES encryption key in CTR mode. To do so, I'm using a PBKDF2 to derive this encryption key using an initial ...
1
vote
1
answer
287
views
Generating HMAC-SHA256 - is this procedure secure enough?
I have 256-bit value (call it "{Secret Value}") and I would like to compute HMAC-SHA256 digest of this value to check its ...
1
vote
1
answer
90
views
Is creating an authentication-key (mac) from the encryption password a vulnerability?
I can think of at least one problem with it - that testing for a correct key (when brute forcing) is simpler with a mac key (at least for short messages) and therefore can help brute force decryption.
1
vote
1
answer
1k
views
Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?
How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. ...
1
vote
1
answer
3k
views
Increased AES key lengths vs keyphrase entropy
I'm selecting an AES key size for a LUKS partition using XTS-PLAIN64.
XTS will effectively reduce the AES key strength in half.
The default key size for AES XTS-PLAIN64 is 256 bits (meaning 128 bits ...
1
vote
1
answer
93
views
Using similar passwords and salts for PBKDF2
I'm trying to generate a bunch of pseudo-random keys for AES using PBKDF2, where the AES ciphers will be used in CTR mode as pseudo-random number generators. My goal is to create a 2-dimensional array,...
1
vote
1
answer
198
views
Adding a Password Hash (key derivation) function to existing password storage solution
As always we are trying to improve password storage; before just adding new ways of storing our password we need to define what threats we will mitigate by adding in a new way to store our password.
...
1
vote
1
answer
2k
views
Importance of salt when deriving an encryption key
I'm very curious to know this and a bit confuses too:
Suppose, I have two files encrypted using AES-128bit with keys PBKDF2-derived from the same password and the same salt. If an attacker does brute ...
1
vote
1
answer
2k
views
Encrypting a payload for transmission over HTTP. AES256 with PBKDF2
I've done some reading about implementing AES256 and deriving a key from a password. If I understand correctly:
I want to generate a new salt (for the key) and a new IV (for the encrypted message) ...
1
vote
1
answer
518
views
PBKDF2 when dkLen and hLen have the same size
I was reading RFC 2898 and something is not clear to me. When I use PBKDF2 with SHA-256 and I want a derived key with length 32 bytes (the same length as my hash function output), your derived key ...
1
vote
2
answers
56
views
Does having a known suffix on the input to PBKDF2 make you more vulnerable?
I have an implementation of PBKDF2, which I know
Has two bytes of '=' at the end of the input
Has an input length of 24 (which is a Base64 encoded character representation of 16 bytes of entropy)
...