76 votes

Why does the FBI ask Apple for help to decrypt an iPhone?

I'll try to take a stab at this. From Apple's iOS Security Guide, we learn that The metadata of all files in the file system is encrypted with a random key, which is created when iOS is first ...
Johannes Weiss's user avatar
46 votes
Accepted

What is the practical impact of using System.Random which is not cryptographically random?

You asked for the practical impact, so the answer is that for \$120 I could probably have your entire password database done by tomorrow. Here is your program, or something similar to it: ...
ymbirtt's user avatar
  • 678
36 votes
Accepted

Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?

The HKDF paper provides as good a summary as any: A Key derivation function (KDF) is a basic and essential component of cryptographic systems: Its goal is to take a source of initial keying material, ...
Luis Casillas's user avatar
33 votes
Accepted

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

The algorithms themselves just output binary (i.e. bytes) if you read their specifications. It's the implementation in API's and applications that output the hexadecimals and/or base64. Sometimes ...
Maarten Bodewes - mod election's user avatar
29 votes

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

Using Base64/HEX has nothing to do with security of a hash algorithm. Base64 and HEX are ways to represent binary data, which is the actual output of a hash algorithm. Base64 is shorter simple ...
DDoSolitary's user avatar
26 votes

What is the practical impact of using System.Random which is not cryptographically random?

From what you have described, it sounds like your system works as follows: Consult the system clock to find a 32-bit seed $s$. Use System.Random to generate a ...
Squeamish Ossifrage's user avatar
24 votes
Accepted

Is there a hash function that's more expensive for an attacker than for the server?

That's is an interesting idea (that was new to me) and turns out to be known as (random) peppering, as pointed in these comments. Indeed, the average number of evaluations of $H'$ by the server when ...
fgrieu - mod election time's user avatar
21 votes
Accepted

Can any MAC be used as a KDF?

No. A MAC guarantees unforgeability but not pseudorandomness. It is true that all MACs that I can think of right now are essential pseudorandom functions, but this does not mean that the MAC ...
Yehuda Lindell's user avatar
21 votes
Accepted

Why does Signal repeatedly hash the secure passphrase?

Cryptographic hashes are designed to be fast and collision resistant. It turns out that when hashing passwords, it is more secure to have a slow hash function. One way to make a fast hash function ...
mikeazo's user avatar
  • 38.6k
19 votes

How many KDF rounds for an SSH key?

Slower is better, as slow as you can tolerate. Timing for different -a values, each measured 20 times: ...
Luc's user avatar
  • 1,508
19 votes
Accepted

What exactly does s2k do in gpg

The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a ...
Thomas Pornin's user avatar
19 votes
Accepted

Do I need to sanitize user input to scrypt, or to PBKDF's in general?

No, you do not need to do escaping or sanitization on data that you pass in as the user input to these functions. They accept arbitrary byte sequences, so any arbitrary byte sequence you pass is ...
bk2204's user avatar
  • 3,126
18 votes

What is the practical impact of using System.Random which is not cryptographically random?

The official documentation for System.Random explicitly says it should not be used for generating passwords. It’s predictable, and seeded only from the system clock. This means System.Random has at ...
rmalayter's user avatar
  • 2,297
17 votes

Why does the FBI ask Apple for help to decrypt an iPhone?

The encryption key isn't derived only from the passcode; it's also derived from a number of cryptographic keys etched directly into the CPU's silicon. These keys are impossible to read out in software—...
Becca Royal-Gordon's user avatar
17 votes
Accepted

How many KDF rounds for an SSH key?

I did also tried to find a good value for the -a flag, in a MacBook Pro Mid14 (i7), trying to login in to a Debian 8.5, I had this results: ...
zzantares's user avatar
  • 302
17 votes

Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?

KDF's or Key Derivation Functions are functions or schemes to derive key or output keying material (OKM) from other secret information, the input keying material (IKM). That information may be another ...
Maarten Bodewes - mod election's user avatar
16 votes
Accepted

Relationship between PRF/KDF/MAC?

A key derivation function (KDF) takes in some secret keying material, which may or may not be uniformly distributed, and where the adversary may also have some auxiliary information about the keying ...
hakoja's user avatar
  • 2,725
16 votes
Accepted

Multiple AES Key Derivation from a master key

Multiple Key Generation from a Master key HMAC-based Key Derivation Function (HKDF) rfc5869 is what you are looking for. HMAC security proof uses the fact that the compression function of the ...
kelalaka's user avatar
  • 48.3k
16 votes

How much security is gained from hiding the nonce?

Nonces (and initialization vectors) are generally public. Assuming a sensible implementation (using a hash of the message as the nonce is not sensible), then no meaningful security is gained by making ...
hunter's user avatar
  • 3,955
15 votes
Accepted

Is deriving the IV from the password secure?

Yes, it is. PBKDF2 derives a DK, a "derived key", which is indistinguishable from random. This is mainly because function within PBKDF2 is HMAC, and HMAC is a PRF. Let's see the definition from ...
Maarten Bodewes - mod election's user avatar
15 votes
Accepted

Is SHA 2 suitable for key derivation?

In principle raw SHA2 is suitable for deriving an AES key from a DH shared secret. But the "proper" solution is to use a KDF. My preferred choice is HKDF, which can use SHA256 as the underlying hash ...
CodesInChaos's user avatar
  • 24.8k
15 votes

Is SHA 2 suitable for key derivation?

Yes. Actually any cryptographic hash function should be fine and allow you to reduce the problem of breaking your AES encryption to either: breaking your DH protocol, this follows from the fact that ...
Lery's user avatar
  • 7,649
14 votes

Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?

SHA-512 has both a larger internal state and a higher number of rounds than SHA-256 - which means that it provides a higher bit strength. Somewhat surprisingly it may also outperform SHA-256, as it ...
Maarten Bodewes - mod election's user avatar
14 votes
Accepted

How much security is gained from hiding the nonce?

Hiding the nonce provides no tangible benefit. In the case of ChaCha where the input block is the concatenation of a constant, the key, a nonce, and a counter, using a random and secret nonce could be ...
forest's user avatar
  • 15.2k
13 votes
Accepted

Can any block cipher in CTR mode be used as a CSPRNG?

can any block cipher in CTR mode be used as a CSPRNG? Formally speaking the CTR mode transforms a PRF (or a PRP) into a PRG and as the PRP notion is the standard notion to model block ciphers, pretty ...
SEJPM's user avatar
  • 45.9k
13 votes
Accepted

Questions about the argon2 options

The entire point of a key-derivation function like Argon2 is to increase the time (difficulty) it takes to create a key, and as a side effect, increase the resources required to attack the key. The ...
BinaryEvolved's user avatar
13 votes
Accepted

Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?

Assume you have an IND-CCA secure cryptosystem $E$ that runs a password through a slow KDF and implicitly handles salts and random IVs, a human-chosen password $p$, and messages $m_1$ through $m_n$ to ...
forest's user avatar
  • 15.2k
12 votes

Why does Signal repeatedly hash the secure passphrase?

Am I correct in assuming that this does not add any extra security? No. This does add security and is a standard practice when dealing with passwords. What they do there is called a password hashing ...
SEJPM's user avatar
  • 45.9k
11 votes
Accepted

Argon2i versus Argon2d?

TL;DR: You want to use Argon2d here. Even though Argon2 was standardized only somewhat recently, it is the result of the Password-Hashing Competition (2013-2015) and was a late re-design of Argon ...
SEJPM's user avatar
  • 45.9k

Only top scored, non community-wiki answers of a minimum length are eligible