78
votes
Why does the FBI ask Apple for help to decrypt an iPhone?
I'll try to take a stab at this. From Apple's iOS Security Guide, we learn that
The metadata of all files in the file system is encrypted with a random key, which
is created when iOS is first ...
- 881
45
votes
Accepted
What is the practical impact of using System.Random which is not cryptographically random?
You asked for the practical impact, so the answer is that for \$120 I could probably have your entire password database done by tomorrow.
Here is your program, or something similar to it:
...
- 658
32
votes
Password hashing security of argon2 versus bcrypt/PBKDF2?
Coming up with a specific number is hard. Realistically, all three options take you well out of the realm of ever having more than the absolute worst passwords brute-forced by an attacker.
The primary ...
- 10.7k
31
votes
Accepted
Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?
The HKDF paper provides as good a summary as any:
A Key derivation function (KDF) is a basic and essential component of cryptographic systems: Its goal is to take a source of initial keying material, ...
- 14k
29
votes
Accepted
Looking at hash output – is Base64 encoding in any way better than HEX encoding?
The algorithms themselves just output binary (i.e. bytes) if you read their specifications. It's the implementation in API's and applications that output the hexadecimals and/or base64.
Sometimes ...
- 85.8k
28
votes
Looking at hash output – is Base64 encoding in any way better than HEX encoding?
Using Base64/HEX has nothing to do with security of a hash algorithm.
Base64 and HEX are ways to represent binary data, which is the actual output of a hash algorithm.
Base64 is shorter simple ...
- 426
26
votes
What is the practical impact of using System.Random which is not cryptographically random?
From what you have described, it sounds like your system works as follows:
Consult the system clock to find a 32-bit seed $s$.
Use System.Random to generate a ...
21
votes
Accepted
Can any MAC be used as a KDF?
No. A MAC guarantees unforgeability but not pseudorandomness. It is true that all MACs that I can think of right now are essential pseudorandom functions, but this does not mean that the MAC ...
- 27k
21
votes
Accepted
Why does Signal repeatedly hash the secure passphrase?
Cryptographic hashes are designed to be fast and collision resistant. It turns out that when hashing passwords, it is more secure to have a slow hash function. One way to make a fast hash function ...
- 37.8k
19
votes
Accepted
What exactly does s2k do in gpg
The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a ...
- 84.8k
19
votes
Accepted
Do I need to sanitize user input to scrypt, or to PBKDF's in general?
No, you do not need to do escaping or sanitization on data that you pass in as the user input to these functions. They accept arbitrary byte sequences, so any arbitrary byte sequence you pass is ...
- 1,657
18
votes
What is the practical impact of using System.Random which is not cryptographically random?
The official documentation for System.Random explicitly says it should not be used for generating passwords. It’s predictable, and seeded only from the system clock. This means System.Random has at ...
- 2,217
17
votes
Why does the FBI ask Apple for help to decrypt an iPhone?
The encryption key isn't derived only from the passcode; it's also derived from a number of cryptographic keys etched directly into the CPU's silicon. These keys are impossible to read out in software—...
16
votes
Accepted
On AES, is a true random string enough for a key?
Even if the 32 characters are completely random, they won't contain non-printable characters. Actually, there are only about 107 printable characters in ASCII (out of 256 values for a full byte) and ...
- 85.8k
16
votes
Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?
KDF's or Key Derivation Functions are functions or schemes to derive key or output keying material (OKM) from other secret information, the input keying material (IKM). That information may be another ...
- 85.8k
16
votes
Accepted
Multiple AES Key Derivation from a master key
Multiple Key Generation from a Master key
HMAC-based Key Derivation Function (HKDF) rfc5869 is what you are looking for. HMAC security proof uses the fact that the compression function of the ...
- 43.5k
15
votes
Accepted
How many KDF rounds for an SSH key?
I did also tried to find a good value for the -a flag, in a MacBook Pro Mid14 (i7), trying to login in to a Debian 8.5, I had this results:
...
- 282
15
votes
Accepted
Is deriving the IV from the password secure?
Yes, it is. PBKDF2 derives a DK, a "derived key", which is indistinguishable from random. This is mainly because function within PBKDF2 is HMAC, and HMAC is a PRF. Let's see the definition from ...
- 85.8k
15
votes
Accepted
Is SHA 2 suitable for key derivation?
In principle raw SHA2 is suitable for deriving an AES key from a DH shared secret.
But the "proper" solution is to use a KDF. My preferred choice is HKDF, which can use SHA256 as the underlying hash ...
- 24.1k
15
votes
Is SHA 2 suitable for key derivation?
Yes.
Actually any cryptographic hash function should be fine and allow you to reduce the problem of breaking your AES encryption to either:
breaking your DH protocol, this follows from the fact that ...
- 7,266
14
votes
Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?
SHA-512 has both a larger internal state and a higher number of rounds than SHA-256 - which means that it provides a higher bit strength. Somewhat surprisingly it may also outperform SHA-256, as it ...
- 85.8k
13
votes
How many KDF rounds for an SSH key?
Slower is better, as slow as you can tolerate. Timing for different -a values, each measured 20 times:
...
- 1,406
13
votes
Accepted
Can any block cipher in CTR mode be used as a CSPRNG?
can any block cipher in CTR mode be used as a CSPRNG?
Formally speaking the CTR mode transforms a PRF (or a PRP) into a PRG and as the PRP notion is the standard notion to model block ciphers, pretty ...
- 44.7k
13
votes
Accepted
Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?
Assume you have an IND-CCA secure cryptosystem $E$ that runs a password through a slow KDF and implicitly handles salts and random IVs, a human-chosen password $p$, and messages $m_1$ through $m_n$ to ...
- 13.5k
12
votes
Accepted
Deterministically generate a RSA public/private key pair from a passphrase (with sufficient entropy)?
Yes, it is possible to deterministically generate public/private RSA key pairs from passphrases. For even passable security, the passphrase must be processed by a key-stretching function, such as ...
- 125k
12
votes
Accepted
Questions about the argon2 options
The entire point of a key-derivation function like Argon2 is to increase the time (difficulty) it takes to create a key, and as a side effect, increase the resources required to attack the key.
The ...
- 258
12
votes
Why does Signal repeatedly hash the secure passphrase?
Am I correct in assuming that this does not add any extra security?
No. This does add security and is a standard practice when dealing with passwords. What they do there is called a password hashing ...
- 44.7k
12
votes
Accepted
Relationship between PRF/KDF/MAC?
A key derivation function (KDF) takes in some secret keying material, which may or may not be uniformly distributed, and where the adversary may also have some auxiliary information about the keying ...
- 2,585
11
votes
Why don’t all AES encryption tools produce the same key from the same password?
There are two things here:
Encryption uses mode of operation, and not "AES alone". Some of them are randomized by an initialization vector - that means the encryption of the same text under the same ...
- 12.3k
Only top scored, non community-wiki answers of a minimum length are eligible