46
votes
Accepted
What is the practical impact of using System.Random which is not cryptographically random?
You asked for the practical impact, so the answer is that for \$120 I could probably have your entire password database done by tomorrow.
Here is your program, or something similar to it:
...
- 678
36
votes
Accepted
Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?
The HKDF paper provides as good a summary as any:
A Key derivation function (KDF) is a basic and essential component of cryptographic systems: Its goal is to take a source of initial keying material, ...
- 14.6k
33
votes
Accepted
Looking at hash output – is Base64 encoding in any way better than HEX encoding?
The algorithms themselves just output binary (i.e. bytes) if you read their specifications. It's the implementation in API's and applications that output the hexadecimals and/or base64.
Sometimes ...
- 93.9k
29
votes
Looking at hash output – is Base64 encoding in any way better than HEX encoding?
Using Base64/HEX has nothing to do with security of a hash algorithm.
Base64 and HEX are ways to represent binary data, which is the actual output of a hash algorithm.
Base64 is shorter simple ...
- 436
26
votes
What is the practical impact of using System.Random which is not cryptographically random?
From what you have described, it sounds like your system works as follows:
Consult the system clock to find a 32-bit seed $s$.
Use System.Random to generate a ...
- 49.1k
24
votes
Accepted
Is there a hash function that's more expensive for an attacker than for the server?
That's is an interesting idea (that was new to me) and turns out to be known as (random) peppering, as pointed in these comments.
Indeed, the average number of evaluations of $H'$ by the server when ...
- 144k
21
votes
Accepted
Why does Signal repeatedly hash the secure passphrase?
Cryptographic hashes are designed to be fast and collision resistant. It turns out that when hashing passwords, it is more secure to have a slow hash function. One way to make a fast hash function ...
- 38.8k
19
votes
How many KDF rounds for an SSH key?
Slower is better, as slow as you can tolerate. Timing for different -a values, each measured 20 times:
...
- 1,528
19
votes
Accepted
What exactly does s2k do in gpg
The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a ...
- 87.7k
19
votes
Accepted
Do I need to sanitize user input to scrypt, or to PBKDF's in general?
No, you do not need to do escaping or sanitization on data that you pass in as the user input to these functions. They accept arbitrary byte sequences, so any arbitrary byte sequence you pass is ...
- 3,516
18
votes
What is the practical impact of using System.Random which is not cryptographically random?
The official documentation for System.Random explicitly says it should not be used for generating passwords. It’s predictable, and seeded only from the system clock. This means System.Random has at ...
- 2,297
17
votes
Accepted
How many KDF rounds for an SSH key?
I did also tried to find a good value for the -a flag, in a MacBook Pro Mid14 (i7), trying to login in to a Debian 8.5, I had this results:
...
- 302
17
votes
Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?
KDF's or Key Derivation Functions are functions or schemes to derive key or output keying material (OKM) from other secret information, the input keying material (IKM). That information may be another ...
- 93.9k
16
votes
Accepted
Relationship between PRF/KDF/MAC?
A key derivation function (KDF) takes in some secret keying material, which may or may not be uniformly distributed, and where the adversary may also have some auxiliary information about the keying ...
- 2,735
16
votes
Accepted
Multiple AES Key Derivation from a master key
Multiple Key Generation from a Master key
HMAC-based Key Derivation Function (HKDF) rfc5869 is what you are looking for. HMAC security proof uses the fact that the compression function of the ...
- 49.3k
16
votes
How much security is gained from hiding the nonce?
Nonces (and initialization vectors) are generally public. Assuming a sensible implementation (using a hash of the message as the nonce is not sensible), then no meaningful security is gained by making ...
- 3,987
15
votes
Accepted
Is deriving the IV from the password secure?
Yes, it is. PBKDF2 derives a DK, a "derived key", which is indistinguishable from random. This is mainly because function within PBKDF2 is HMAC, and HMAC is a PRF. Let's see the definition from ...
- 93.9k
15
votes
Accepted
Is SHA 2 suitable for key derivation?
In principle raw SHA2 is suitable for deriving an AES key from a DH shared secret.
But the "proper" solution is to use a KDF. My preferred choice is HKDF, which can use SHA256 as the underlying hash ...
- 25k
15
votes
Is SHA 2 suitable for key derivation?
Yes.
Actually any cryptographic hash function should be fine and allow you to reduce the problem of breaking your AES encryption to either:
breaking your DH protocol, this follows from the fact that ...
- 7,759
15
votes
Accepted
How much security is gained from hiding the nonce?
Hiding the nonce provides no tangible benefit. In the case of ChaCha where the input block is the concatenation of a constant, the key, a nonce, and a counter, using a random and secret nonce could be ...
- 15.4k
14
votes
Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?
SHA-512 has both a larger internal state and a higher number of rounds than SHA-256 - which means that it provides a higher bit strength. Somewhat surprisingly it may also outperform SHA-256, as it ...
- 93.9k
13
votes
Accepted
Can any block cipher in CTR mode be used as a CSPRNG?
can any block cipher in CTR mode be used as a CSPRNG?
Formally speaking the CTR mode transforms a PRF (or a PRP) into a PRG and as the PRP notion is the standard notion to model block ciphers, pretty ...
- 46.3k
13
votes
Accepted
Questions about the argon2 options
The entire point of a key-derivation function like Argon2 is to increase the time (difficulty) it takes to create a key, and as a side effect, increase the resources required to attack the key.
The ...
- 268
13
votes
Accepted
Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?
Assume you have an IND-CCA secure cryptosystem $E$ that runs a password through a slow KDF and implicitly handles salts and random IVs, a human-chosen password $p$, and messages $m_1$ through $m_n$ to ...
- 15.4k
12
votes
Why does Signal repeatedly hash the secure passphrase?
Am I correct in assuming that this does not add any extra security?
No. This does add security and is a standard practice when dealing with passwords. What they do there is called a password hashing ...
- 46.3k
11
votes
Accepted
Argon2i versus Argon2d?
TL;DR: You want to use Argon2d here.
Even though Argon2 was standardized only somewhat recently, it is the result of the Password-Hashing Competition (2013-2015) and was a late re-design of Argon ...
- 46.3k
11
votes
Accepted
Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?
Yes! You can use the ephemeral key derivation mechanism that is for example used in Monero (they call it stealth keys there).
Consider public key $A=aG$, with private key $a$. Then, a derived key can ...
- 2,430
10
votes
Accepted
Can a raw ECDH shared secret be used directly for encryption?
If two parties calculate an ECDH shared secret can they (with no security weakness) use this raw value directly as an encryption key?
If the ECDH curve size is large enough, then yes, there is no ...
- 150k
9
votes
Is it better to maximize memory usage or number of passes with Argon2i 1.3?
As of October 2017, the resource I've found most useful for getting a quick, practical sense of how pick parameters for Argon2 is the (still draft) RFC, in particular section 9, which gives this ...
- 14.6k
Only top scored, non community-wiki answers of a minimum length are eligible