Questions tagged [scrypt]
A slow and memory-intensive hash function designed for passwords
84
questions
2
votes
2
answers
430
views
Obsidian.md's "end-to-end" encryption & privacy
Obsidian.md claims
End-to-end encryption means that the data is encrypted from the moment it leaves your device, and can only be decrypted using your encryption key once it's back on one of your ...
- 21
0
votes
0
answers
70
views
Is it safe to store AES-KW encrypted key in database?
Use Case:
Web application accessed in browser. Registered users can store personal notes in the application, these notes are stored in a SQL database on a online server. The user can store unencrypted ...
user109145
1
vote
0
answers
208
views
Is my TypeScript scrypt implementation using Web Crypto API safe and correct? (Open Source)
I want to use TweetNaCl.js for encrypting user data that is stored in LocalStorage. Therefore, I want to prompt the user to provide a PIN/password that shall be ...
- 111
1
vote
2
answers
94
views
How to safely and randomly iterate a key derived from Scrypt?
I'm developing a way to deterministically generate private keys for arbitrary elliptic curves based on some user-input (a brain-wallet). Currently, I'm using the Scrypt password hashing algorithm with ...
- 43
1
vote
1
answer
705
views
Salt value in scrypt algorithm
I see there are a lot of questions relating to handling of a salt value but nothing I have seen so far has cleared the following question.
When using a KDF such a scrypt, I believe the value of the ...
- 55
3
votes
0
answers
785
views
What does j9T mean in yescrypt (from /etc/shadow)? [closed]
For example I have a shadow string
$y$j9T$PaFEMV0mbpeadmHDv0Lp31$G/LliR3MqgdjEBcFC1E.s/3vlRofsZ0Wn5JyZHXAol5
There are 4 parts
id : y (yescrypt)
param : j9T
salt :...
- 131
2
votes
1
answer
167
views
Is SHA1 break significant for an algorithm intended to be Proof-Of-Work?
Let's say I'm modifying the Scrypt hash function (https://github.com/Tarsnap/scrypt/blob/master/lib/crypto/crypto_scrypt-ref.c) and that all I want to do is replace SHA256 with SHA1 in the code to ...
7
votes
2
answers
1k
views
Do I need to sanitize user input to scrypt, or to PBKDF's in general?
I'd like to allow the user to supply a password as input to some PBKDF, which I will use to construct a key for file encryption (currently using aes-256-ctr. It may change as I learn more).
I am ...
- 181
1
vote
2
answers
158
views
is it safe to combine scrypt with other hash algorithms?
I'm currently writing a file encryption program, and I designed this scheme to derive a key from user input password:
...
- 47
0
votes
0
answers
228
views
How to estimate time / difficulty to brute force scrypt (or similar) hash at various short fixed lengh outputs?
My particular use case is a hash function that:
Is slow / computationally expensive. It would take a pretty long time, or be infeasible to guess the input, if the hash output and the algorithm are ...
1
vote
1
answer
462
views
Do I need a salt for Scrypt if the data is client-side?
I have a web app, in which I am encrypting user data client side. Each client has their own password, which is used to derive an encryption key (via Scrypt) for encrypting their data. Since the data ...
- 421
0
votes
0
answers
163
views
How secure is file-based encryption in Android?
I want to estimate the cost of breaking file-based encryption in Android given a password entropy. The only information I found so far is this:
The stretched credential is the user credential after ...
- 291
6
votes
0
answers
188
views
Is Argon2 "sequential memory hard"?
The Scrypt paper here defines memory-hard and sequential memory hard functions as follows:
Definition 1. A memory-hard algorithm on a Random Access Machine is an algorithm which uses $S(n)$ space and ...
- 1,443
1
vote
1
answer
385
views
What does "sequential memory-hard" mean?
I found this term in Scrypt's paper. I have several questions about its meaning, ranging from how to parse it, to theoretical bounds:
Q1: How to parse it?
Is it read ...
- 563
2
votes
1
answer
310
views
How to estimate the maximum computational cost bound for Key Derivation Functions (KDFs) before it becomes useless security-wise?
From my understanding of Key Derivation Functions (KDFs), e.g. scrypt, Argon2, etc, we can tune their parameters such that it eventually becomes harder for an attacker to brute force a password-to-key ...
- 563
0
votes
1
answer
65
views
How to use Botan to verify a web3 wallet/password?
The specification here seems quite clear, but unfortunately I'm still doing something wrong...
I have this (single small c++ file) repository which very straightforwardly follows the password/wallet ...
- 121
3
votes
1
answer
167
views
How much information do I leak if I upload multiple ciphertexts with cleartext overlaps?
Suppose that $t_1, t_2, \ldots, t_n$ are my clear texts. Suppose that for any $(i,j) \in \{1,2,\ldots,n\}^2$, $t_i$ and $t_j$ only differ in, say, the 1st $m$-many characters. Finally, suppose that I ...
- 563
1
vote
1
answer
148
views
Combining algorithms for password storage?
Is it more secure to combine algorithms for password hashing, for example, Scrypt, Bcrypt, SHA-3, etc.? If an attacker wants to use dedicated hardware, he would need one for each algorithm. However, I ...
- 373
2
votes
1
answer
929
views
Is it safe to reuse the same nonce for decryption an indefinite amount of times in this context?
I'm creating a password management application and I'm considering using the following procedure to keep passwords safe:
Asking the user for raw_password, for ...
- 417
2
votes
2
answers
272
views
Is this correct/incorrect password for file encryption scheme secure?
I'm writing an AES file encryption program, and I'd like to put in a way to tell whether or not the user has entered the correct password without decrypting the entire file and GCM telling me the tag ...
0
votes
0
answers
19
views
Scrypt cipher - known vulnerabilities and cryptanalysis? [duplicate]
there is a Scrypt cipher which is used for exmaple by some cryptos like LItecoin for their mining algorithm.
I never heared of scrypt. I know eg SHA256 which is well analyzed and considered as secure ...
- 211
1
vote
2
answers
814
views
Scrypt KDF cipher (scrypt CLI) - known vulnerabilities and cryptanalysis?
There is a scrypt cipher that is used for example by some cryptos like LItecoin for their mining algorithm.
I never heard of scrypt. I know eg SHA-256 which is well analyzed and considered as secure ...
- 211
0
votes
1
answer
168
views
Hashing high entropy key into AES format
If I have a high entropy key (ECDHE shared secret), what type of hash should I use to format this into an AES-256 key? Is Sha256 or Sha3_256 sufficient to maintain entropy or do I need to use a KDF (...
- 613
1
vote
1
answer
315
views
Is it safe to reuse the password when using AES-CTR with scrypt?
I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does:
...
- 153
1
vote
2
answers
1k
views
Password Hashing Security Using Scrypt & Argon2
I am developing an app where the following cryptographic system will be in place:
Elliptic Curve key exchange (curve: secp521r1)
Double Scrypt the shared secret with different salts
Pass this result ...
- 613
0
votes
2
answers
169
views
Is it Ok in practice to rely only on the first 64 bits of a scrypt hash in this scenario?
I’m in a situation where I need to perform authentication against a large set of exactly 8 bytes longs passwords (with however full choice of encoding from the user and even custom encoding support): ...
- 153
0
votes
1
answer
151
views
What is a SHA1_Compress() function?
I'm trying to implement the scrypt key derivation function using JavaScript. When implementing the algorithm, I found that there was a function called SHA1_Compress listed in the specification. Is the ...
- 1
1
vote
1
answer
302
views
How to make my hash more robust to the brute force?
I'm using PBKDF2 SHA 256 with 100 000 iterations to generate a secret.
I want to increase the cost of brute forcing the passphrase I use to generate the secret.
I'm thinking of using scrypt after ...
1
vote
2
answers
450
views
Key derivation: bit lengths
This is a follow-up question to
HKDF: ikm, salt and info values
Based on the feedback, I have now decided to implement my key derivation for AES-GCM-256 file encryption roughly as follows:
...
- 71
3
votes
1
answer
2k
views
HKDF: ikm, salt and info values
As indicated at
Key generation for AES-GCM-256 file encryption
I'm currently working on a file encryption software. In the above thread it was suggested that, for performance reasons, I use a ...
- 71
5
votes
1
answer
227
views
Login security and plaintext of a password stored in Argon2i to derive a key via halite safe?
I'm using Symfony 4. I have set parameters on all my Argon2 stuff below so that it takes 1s per iteration. This website is supposed to encrypt HIPAA information.
Basically I have a table like this
<...
- 103
0
votes
1
answer
147
views
Scrypt sanity check
I have an implementation of scrypt that doesn’t produce the same output as an online scrypt key generator I found. For example, if I run my own scrypt in a function like this:
...
- 35
3
votes
1
answer
613
views
If and why is it bad to scrypt a bcrypted password?
This has been already brought up on security SE, but very sadly, this particular interesting issue got watered down in a far broader question.
If and why is it bad to use the following hashing ...
- 159
1
vote
1
answer
47
views
Encryption program conseil
I'm writing a little program to encrypt and decrypt a file. I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). I have read some articles about cryptography but I have ...
- 35
0
votes
1
answer
149
views
is it safe to leak some information about scrypt result?
I am encrypting a file via AES-CBC and am using scrypt to extract a key from a user-provided password. The IV is public and is stored with the encrypted file.
Is it safe to generate my IV (public) ...
- 364
1
vote
0
answers
128
views
Scrypt with weak parameters, for proof of work?
I need a proof of work/memory that takes about 100ms to complete, and as short time as possible to validate. Hashing random values and a nounce to get enough leading zeroes is my current approach, and ...
- 1,003
1
vote
4
answers
2k
views
I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error
People seem to mostly recommend scrypt these days, but I'm not sure if this should be the case? I'll structure this post by just making an argument for PBKDF2 over Scrypt and then you can reply ...
- 11
2
votes
1
answer
698
views
scrypt and argon2: binary safe?
for bcrypt it's probably common knowledge that it isnt binary safe because it uses null termination, which means that when bcrypt is used you need to make sure that no one does these (e.g. by hashing ...
- 330
1
vote
1
answer
288
views
How to generate two different keys out of a single password?
I'm designing a system in which a password is used both for logging in as well as for encrypting some payload.
To encrypt a payload I derive a key from the password. Very straightforward so far.
...
- 125
13
votes
1
answer
8k
views
argon2 vs scrypt
It's a fact that scrypt and argon2 are the two dominant memory hard KDFs.
But which one of them is more recommendable for password hashing? scrypt is older and as far as I know resistant to almost ...
- 4,415
16
votes
4
answers
19k
views
Looking at hash output – is Base64 encoding in any way better than HEX encoding?
I was wondering why most "normal/unsafe" crypto hashes like SHA-256, SHA-512, Whirlpool, RipeMD-160, MD5, etc. are HEX encoded.
But most "secure" crypto hashes (KDF' ) like ...
- 4,415
0
votes
1
answer
446
views
Do I need to worry about the IV if I use a 32 byte random salt with SCrypt and AES-GCM?
I am encrypting a DEK (data encryption key) with a KEK (key encryption key). The KEK is generated from a password using scrypt with default parameters and a 32 byte randomly generated salt. The ...
- 360
0
votes
1
answer
4k
views
extract password hashed in scrypt using hash and salt [closed]
I have the hashed password and its salt. It is encrypted using SCRYPT by firebase.
How can I extract the plain text password from these two?
Or alternatively, how can I re-encrypt or convert them ...
- 101
1
vote
1
answer
1k
views
Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?
How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. ...
- 105
11
votes
1
answer
15k
views
Should I use SHA256 or Blake2 to checksum and sign scrypt headers?
I use scrypt as a key derivation function (not to store passwords). To pass around the detached key header I use the standard encoding as implemented in Colin Percival's scrypt implementation (...
- 113
5
votes
1
answer
356
views
How does blockmix in scrypt work? What is the meaning of the H function in scrypt?
I am trying to understand how scrypt works. I am referring to the Algorithm section of scrypt's Wikipedia page. There I find ...
- 1,375
-1
votes
1
answer
1k
views
20 bytes random string hashed with unsalted bcrypt or scrypt?
I have users for which I use a SHA-1 hash as an API key. These are urandom feed into SHA-1 so you can assume they're fully random. There is no username sent along with the API key. I don't want to ...
- 1
4
votes
1
answer
597
views
What do the last chunks of the output string of Scrypt contain?
When you use scrypt to hash a string, it will generate something like:
...
- 171
3
votes
1
answer
158
views
Attacking Scrypt Under Access Pattern Leakage
Could cache-timing channels (such as exist for certain
block ciphers) somehow be made use of in order to extract memory-access pattern information if both the attacker and user are NOT in a shared ...
- 233
10
votes
2
answers
7k
views
Appropriate scrypt parameters when generating an scrypt hash
What values for CPU, memory and parallel difficulty should be used when generating an scrypt hash? i.e.
...
- 233