Questions tagged [scrypt]
A slow and memory-intensive hash function designed for passwords
84
questions
1
vote
0
answers
304
views
Is my TypeScript scrypt implementation using Web Crypto API safe and correct? (Open Source)
I want to use TweetNaCl.js for encrypting user data that is stored in LocalStorage. Therefore, I want to prompt the user to provide a PIN/password that shall be ...
- 109
2
votes
2
answers
982
views
Obsidian.md's "end-to-end" encryption & privacy
Obsidian.md claims
End-to-end encryption means that the data is encrypted from the moment it leaves your device, and can only be decrypted using your encryption key once it's back on one of your ...
- 160
0
votes
0
answers
86
views
Is it safe to store AES-KW encrypted key in database?
Use Case:
Web application accessed in browser. Registered users can store personal notes in the application, these notes are stored in a SQL database on a online server. The user can store unencrypted ...
CommunityBot
- 1
3
votes
1
answer
164
views
Attacking Scrypt Under Access Pattern Leakage
Could cache-timing channels (such as exist for certain
block ciphers) somehow be made use of in order to extract memory-access pattern information if both the attacker and user are NOT in a shared ...
- 962
16
votes
4
answers
20k
views
Looking at hash output – is Base64 encoding in any way better than HEX encoding?
I was wondering why most "normal/unsafe" crypto hashes like SHA-256, SHA-512, Whirlpool, RipeMD-160, MD5, etc. are HEX encoded.
But most "secure" crypto hashes (KDF' ) like ...
- 92.6k
25
votes
2
answers
17k
views
What is the difference between Scrypt and PBKDF2?
After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2.
As far as I understood, the similarity is:
both are password-based key derivation ...
- 197
1
vote
2
answers
106
views
How to safely and randomly iterate a key derived from Scrypt?
I'm developing a way to deterministically generate private keys for arbitrary elliptic curves based on some user-input (a brain-wallet). Currently, I'm using the Scrypt password hashing algorithm with ...
1
vote
1
answer
897
views
Salt value in scrypt algorithm
I see there are a lot of questions relating to handling of a salt value but nothing I have seen so far has cleared the following question.
When using a KDF such a scrypt, I believe the value of the ...
- 2,611
3
votes
0
answers
957
views
What does j9T mean in yescrypt (from /etc/shadow)? [closed]
For example I have a shadow string
$y$j9T$PaFEMV0mbpeadmHDv0Lp31$G/LliR3MqgdjEBcFC1E.s/3vlRofsZ0Wn5JyZHXAol5
There are 4 parts
id : y (yescrypt)
param : j9T
salt :...
- 131
2
votes
1
answer
174
views
Is SHA1 break significant for an algorithm intended to be Proof-Of-Work?
Let's say I'm modifying the Scrypt hash function (https://github.com/Tarsnap/scrypt/blob/master/lib/crypto/crypto_scrypt-ref.c) and that all I want to do is replace SHA256 with SHA1 in the code to ...
- 48.5k
0
votes
1
answer
73
views
How to use Botan to verify a web3 wallet/password?
The specification here seems quite clear, but unfortunately I'm still doing something wrong...
I have this (single small c++ file) repository which very straightforwardly follows the password/wallet ...
CommunityBot
- 1
7
votes
2
answers
1k
views
Do I need to sanitize user input to scrypt, or to PBKDF's in general?
I'd like to allow the user to supply a password as input to some PBKDF, which I will use to construct a key for file encryption (currently using aes-256-ctr. It may change as I learn more).
I am ...
- 155
1
vote
2
answers
172
views
is it safe to combine scrypt with other hash algorithms?
I'm currently writing a file encryption program, and I designed this scheme to derive a key from user input password:
...
- 342
0
votes
0
answers
279
views
How to estimate time / difficulty to brute force scrypt (or similar) hash at various short fixed lengh outputs?
My particular use case is a hash function that:
Is slow / computationally expensive. It would take a pretty long time, or be infeasible to guess the input, if the hash output and the algorithm are ...
- 219
1
vote
1
answer
491
views
Do I need a salt for Scrypt if the data is client-side?
I have a web app, in which I am encrypting user data client side. Each client has their own password, which is used to derive an encryption key (via Scrypt) for encrypting their data. Since the data ...
- 48.5k
0
votes
0
answers
171
views
How secure is file-based encryption in Android?
I want to estimate the cost of breaking file-based encryption in Android given a password entropy. The only information I found so far is this:
The stretched credential is the user credential after ...
- 291
1
vote
1
answer
396
views
What does "sequential memory-hard" mean?
I found this term in Scrypt's paper. I have several questions about its meaning, ranging from how to parse it, to theoretical bounds:
Q1: How to parse it?
Is it read ...
- 1,443
6
votes
0
answers
197
views
Is Argon2 "sequential memory hard"?
The Scrypt paper here defines memory-hard and sequential memory hard functions as follows:
Definition 1. A memory-hard algorithm on a Random Access Machine is an algorithm which uses $S(n)$ space and ...
- 1,443
1
vote
2
answers
858
views
Scrypt KDF cipher (scrypt CLI) - known vulnerabilities and cryptanalysis?
There is a scrypt cipher that is used for example by some cryptos like LItecoin for their mining algorithm.
I never heard of scrypt. I know eg SHA-256 which is well analyzed and considered as secure ...
CommunityBot
- 1
2
votes
1
answer
324
views
How to estimate the maximum computational cost bound for Key Derivation Functions (KDFs) before it becomes useless security-wise?
From my understanding of Key Derivation Functions (KDFs), e.g. scrypt, Argon2, etc, we can tune their parameters such that it eventually becomes harder for an attacker to brute force a password-to-key ...
- 573
3
votes
1
answer
169
views
How much information do I leak if I upload multiple ciphertexts with cleartext overlaps?
Suppose that $t_1, t_2, \ldots, t_n$ are my clear texts. Suppose that for any $(i,j) \in \{1,2,\ldots,n\}^2$, $t_i$ and $t_j$ only differ in, say, the 1st $m$-many characters. Finally, suppose that I ...
- 141k
7
votes
2
answers
742
views
Scrypt not "old enough" to be safe?
I just check all the questions with scrypt tag about that and usually it's said that scrypt is nice in theory and theoretically better than bcrypt and PKDF2, but it's too young to be "completely safe"....
1
vote
1
answer
163
views
Combining algorithms for password storage?
Is it more secure to combine algorithms for password hashing, for example, Scrypt, Bcrypt, SHA-3, etc.? If an attacker wants to use dedicated hardware, he would need one for each algorithm. However, I ...
- 995
2
votes
1
answer
733
views
Would it be better to use HKDF or SCrypt for deriving a child key?
Okay so I'm trying to derive a child public key from an EC public key. I've come up with a couple ideas and now I'd like to know which is more secure.
Mp: The master key pair, this includes a ...
CommunityBot
- 1
2
votes
1
answer
997
views
Is it safe to reuse the same nonce for decryption an indefinite amount of times in this context?
I'm creating a password management application and I'm considering using the following procedure to keep passwords safe:
Asking the user for raw_password, for ...
CommunityBot
- 1
2
votes
2
answers
275
views
Is this correct/incorrect password for file encryption scheme secure?
I'm writing an AES file encryption program, and I'd like to put in a way to tell whether or not the user has entered the correct password without decrypting the entire file and GCM telling me the tag ...
CommunityBot
- 1
0
votes
0
answers
19
views
Scrypt cipher - known vulnerabilities and cryptanalysis? [duplicate]
there is a Scrypt cipher which is used for exmaple by some cryptos like LItecoin for their mining algorithm.
I never heared of scrypt. I know eg SHA256 which is well analyzed and considered as secure ...
- 211
14
votes
2
answers
2k
views
How to derive two keys from one password
What is the best way to generate two independent symmetric keys from one user-entered password or passphrase?
Would using both scrypt and pbkdf2 achieve this?
- 36.4k
0
votes
1
answer
173
views
Hashing high entropy key into AES format
If I have a high entropy key (ECDHE shared secret), what type of hash should I use to format this into an AES-256 key? Is Sha256 or Sha3_256 sufficient to maintain entropy or do I need to use a KDF (...
- 3,975
1
vote
1
answer
323
views
Is it safe to reuse the password when using AES-CTR with scrypt?
I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does:
...
- 6,424
-1
votes
1
answer
1k
views
20 bytes random string hashed with unsalted bcrypt or scrypt?
I have users for which I use a SHA-1 hash as an API key. These are urandom feed into SHA-1 so you can assume they're fully random. There is no username sent along with the API key. I don't want to ...
- 3,132
1
vote
2
answers
1k
views
Password Hashing Security Using Scrypt & Argon2
I am developing an app where the following cryptographic system will be in place:
Elliptic Curve key exchange (curve: secp521r1)
Double Scrypt the shared secret with different salts
Pass this result ...
- 15.3k
1
vote
1
answer
303
views
How to make my hash more robust to the brute force?
I'm using PBKDF2 SHA 256 with 100 000 iterations to generate a secret.
I want to increase the cost of brute forcing the passphrase I use to generate the secret.
I'm thinking of using scrypt after ...
0
votes
2
answers
175
views
Is it Ok in practice to rely only on the first 64 bits of a scrypt hash in this scenario?
I’m in a situation where I need to perform authentication against a large set of exactly 8 bytes longs passwords (with however full choice of encoding from the user and even custom encoding support): ...
CommunityBot
- 1
0
votes
1
answer
465
views
Do I need to worry about the IV if I use a 32 byte random salt with SCrypt and AES-GCM?
I am encrypting a DEK (data encryption key) with a KEK (key encryption key). The KEK is generated from a password using scrypt with default parameters and a 32 byte randomly generated salt. The ...
- 48.4k
14
votes
1
answer
8k
views
argon2 vs scrypt
It's a fact that scrypt and argon2 are the two dominant memory hard KDFs.
But which one of them is more recommendable for password hashing? scrypt is older and as far as I know resistant to almost ...
CommunityBot
- 1
0
votes
1
answer
160
views
What is a SHA1_Compress() function?
I'm trying to implement the scrypt key derivation function using JavaScript. When implementing the algorithm, I found that there was a function called SHA1_Compress listed in the specification. Is the ...
- 48.4k
1
vote
2
answers
468
views
Key derivation: bit lengths
This is a follow-up question to
HKDF: ikm, salt and info values
Based on the feedback, I have now decided to implement my key derivation for AES-GCM-256 file encryption roughly as follows:
...
- 92.6k
3
votes
1
answer
2k
views
HKDF: ikm, salt and info values
As indicated at
Key generation for AES-GCM-256 file encryption
I'm currently working on a file encryption software. In the above thread it was suggested that, for performance reasons, I use a ...
- 92.6k
5
votes
1
answer
232
views
Login security and plaintext of a password stored in Argon2i to derive a key via halite safe?
I'm using Symfony 4. I have set parameters on all my Argon2 stuff below so that it takes 1s per iteration. This website is supposed to encrypt HIPAA information.
Basically I have a table like this
<...
- 92.6k
11
votes
2
answers
7k
views
Appropriate scrypt parameters when generating an scrypt hash
What values for CPU, memory and parallel difficulty should be used when generating an scrypt hash? i.e.
...
CommunityBot
- 1
0
votes
1
answer
153
views
Scrypt sanity check
I have an implementation of scrypt that doesn’t produce the same output as an online scrypt key generator I found. For example, if I run my own scrypt in a function like this:
...
- 48.4k
3
votes
1
answer
620
views
If and why is it bad to scrypt a bcrypted password?
This has been already brought up on security SE, but very sadly, this particular interesting issue got watered down in a far broader question.
If and why is it bad to use the following hashing ...
- 3,313
4
votes
1
answer
969
views
A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt
I want a key stretching system that's as strong as the stronger of scrypt and PBKDF2. The consensus now is that scrypt is by far the better system, but that might change if in the future, a weakness ...
- 15.3k
1
vote
1
answer
47
views
Encryption program conseil
I'm writing a little program to encrypt and decrypt a file. I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). I have read some articles about cryptography but I have ...
- 48.4k
0
votes
1
answer
150
views
is it safe to leak some information about scrypt result?
I am encrypting a file via AES-CBC and am using scrypt to extract a key from a user-provided password. The IV is public and is stored with the encrypted file.
Is it safe to generate my IV (public) ...
- 48.4k
1
vote
0
answers
138
views
Scrypt with weak parameters, for proof of work?
I need a proof of work/memory that takes about 100ms to complete, and as short time as possible to validate. Hashing random values and a nounce to get enough leading zeroes is my current approach, and ...
- 1,043
1
vote
4
answers
2k
views
I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error
People seem to mostly recommend scrypt these days, but I'm not sure if this should be the case? I'll structure this post by just making an argument for PBKDF2 over Scrypt and then you can reply ...
- 5,836
2
votes
1
answer
723
views
scrypt and argon2: binary safe?
for bcrypt it's probably common knowledge that it isnt binary safe because it uses null termination, which means that when bcrypt is used you need to make sure that no one does these (e.g. by hashing ...
- 46k
1
vote
1
answer
306
views
How to generate two different keys out of a single password?
I'm designing a system in which a password is used both for logging in as well as for encrypting some payload.
To encrypt a payload I derive a key from the password. Very straightforward so far.
...
- 2,940