77
votes
Why does the FBI ask Apple for help to decrypt an iPhone?
I'll try to take a stab at this. From Apple's iOS Security Guide, we learn that
The metadata of all files in the file system is encrypted with a random key, which
is created when iOS is first ...
- 871
46
votes
Accepted
What is the practical impact of using System.Random which is not cryptographically random?
You asked for the practical impact, so the answer is that for \$120 I could probably have your entire password database done by tomorrow.
Here is your program, or something similar to it:
...
- 668
36
votes
Accepted
Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?
The HKDF paper provides as good a summary as any:
A Key derivation function (KDF) is a basic and essential component of cryptographic systems: Its goal is to take a source of initial keying material, ...
- 14.4k
35
votes
Password hashing security of argon2 versus bcrypt/PBKDF2?
Coming up with a specific number is hard. Realistically, all three options take you well out of the realm of ever having more than the absolute worst passwords brute-forced by an attacker.
The primary ...
- 11k
33
votes
Accepted
Looking at hash output – is Base64 encoding in any way better than HEX encoding?
The algorithms themselves just output binary (i.e. bytes) if you read their specifications. It's the implementation in API's and applications that output the hexadecimals and/or base64.
Sometimes ...
- 91.7k
29
votes
Looking at hash output – is Base64 encoding in any way better than HEX encoding?
Using Base64/HEX has nothing to do with security of a hash algorithm.
Base64 and HEX are ways to represent binary data, which is the actual output of a hash algorithm.
Base64 is shorter simple ...
- 436
26
votes
What is the practical impact of using System.Random which is not cryptographically random?
From what you have described, it sounds like your system works as follows:
Consult the system clock to find a 32-bit seed $s$.
Use System.Random to generate a ...
- 47.9k
24
votes
Accepted
Is there a hash function that's more expensive for an attacker than for the server?
That's is an interesting idea (that was new to me) and turns out to be known as (random) peppering, as pointed in these comments.
Indeed, the average number of evaluations of $H'$ by the server when ...
- 138k
21
votes
Accepted
Can any MAC be used as a KDF?
No. A MAC guarantees unforgeability but not pseudorandomness. It is true that all MACs that I can think of right now are essential pseudorandom functions, but this does not mean that the MAC ...
- 27.6k
21
votes
Accepted
Why does Signal repeatedly hash the secure passphrase?
Cryptographic hashes are designed to be fast and collision resistant. It turns out that when hashing passwords, it is more secure to have a slow hash function. One way to make a fast hash function ...
- 38.5k
19
votes
How many KDF rounds for an SSH key?
Slower is better, as slow as you can tolerate. Timing for different -a values, each measured 20 times:
...
- 1,498
19
votes
Accepted
What exactly does s2k do in gpg
The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a ...
- 86.6k
19
votes
Accepted
Do I need to sanitize user input to scrypt, or to PBKDF's in general?
No, you do not need to do escaping or sanitization on data that you pass in as the user input to these functions. They accept arbitrary byte sequences, so any arbitrary byte sequence you pass is ...
- 2,971
18
votes
What is the practical impact of using System.Random which is not cryptographically random?
The official documentation for System.Random explicitly says it should not be used for generating passwords. It’s predictable, and seeded only from the system clock. This means System.Random has at ...
- 2,287
17
votes
Why does the FBI ask Apple for help to decrypt an iPhone?
The encryption key isn't derived only from the passcode; it's also derived from a number of cryptographic keys etched directly into the CPU's silicon. These keys are impossible to read out in software—...
17
votes
Accepted
How many KDF rounds for an SSH key?
I did also tried to find a good value for the -a flag, in a MacBook Pro Mid14 (i7), trying to login in to a Debian 8.5, I had this results:
...
- 302
17
votes
Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?
KDF's or Key Derivation Functions are functions or schemes to derive key or output keying material (OKM) from other secret information, the input keying material (IKM). That information may be another ...
- 91.7k
16
votes
Accepted
On AES, is a true random string enough for a key?
Even if the 32 characters are completely random, they won't contain non-printable characters. Actually, there are only about 107 printable characters in ASCII (out of 256 values for a full byte) and ...
- 91.7k
16
votes
Accepted
Multiple AES Key Derivation from a master key
Multiple Key Generation from a Master key
HMAC-based Key Derivation Function (HKDF) rfc5869 is what you are looking for. HMAC security proof uses the fact that the compression function of the ...
- 47.6k
16
votes
How much security is gained from hiding the nonce?
Nonces (and initialization vectors) are generally public. Assuming a sensible implementation (using a hash of the message as the nonce is not sensible), then no meaningful security is gained by making ...
- 3,945
15
votes
Accepted
Is deriving the IV from the password secure?
Yes, it is. PBKDF2 derives a DK, a "derived key", which is indistinguishable from random. This is mainly because function within PBKDF2 is HMAC, and HMAC is a PRF. Let's see the definition from ...
- 91.7k
15
votes
Accepted
Is SHA 2 suitable for key derivation?
In principle raw SHA2 is suitable for deriving an AES key from a DH shared secret.
But the "proper" solution is to use a KDF. My preferred choice is HKDF, which can use SHA256 as the underlying hash ...
- 24.8k
15
votes
Is SHA 2 suitable for key derivation?
Yes.
Actually any cryptographic hash function should be fine and allow you to reduce the problem of breaking your AES encryption to either:
breaking your DH protocol, this follows from the fact that ...
- 7,629
14
votes
Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?
SHA-512 has both a larger internal state and a higher number of rounds than SHA-256 - which means that it provides a higher bit strength. Somewhat surprisingly it may also outperform SHA-256, as it ...
- 91.7k
14
votes
Accepted
Relationship between PRF/KDF/MAC?
A key derivation function (KDF) takes in some secret keying material, which may or may not be uniformly distributed, and where the adversary may also have some auxiliary information about the keying ...
- 2,695
13
votes
Accepted
Can any block cipher in CTR mode be used as a CSPRNG?
can any block cipher in CTR mode be used as a CSPRNG?
Formally speaking the CTR mode transforms a PRF (or a PRP) into a PRG and as the PRP notion is the standard notion to model block ciphers, pretty ...
- 45.7k
13
votes
Accepted
Questions about the argon2 options
The entire point of a key-derivation function like Argon2 is to increase the time (difficulty) it takes to create a key, and as a side effect, increase the resources required to attack the key.
The ...
- 268
13
votes
Accepted
Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?
Assume you have an IND-CCA secure cryptosystem $E$ that runs a password through a slow KDF and implicitly handles salts and random IVs, a human-chosen password $p$, and messages $m_1$ through $m_n$ to ...
- 15.1k
13
votes
Accepted
How much security is gained from hiding the nonce?
Hiding the nonce provides no tangible benefit. In the case of ChaCha where the input block is the concatenation of a constant, the key, a nonce, and a counter, using a random and secret nonce could be ...
- 15.1k
Only top scored, non community-wiki answers of a minimum length are eligible