78 votes

Why does the FBI ask Apple for help to decrypt an iPhone?

I'll try to take a stab at this. From Apple's iOS Security Guide, we learn that The metadata of all files in the file system is encrypted with a random key, which is created when iOS is first ...
user avatar
45 votes
Accepted

What is the practical impact of using System.Random which is not cryptographically random?

You asked for the practical impact, so the answer is that for \$120 I could probably have your entire password database done by tomorrow. Here is your program, or something similar to it: ...
user avatar
  • 658
32 votes

Password hashing security of argon2 versus bcrypt/PBKDF2?

Coming up with a specific number is hard. Realistically, all three options take you well out of the realm of ever having more than the absolute worst passwords brute-forced by an attacker. The primary ...
user avatar
31 votes
Accepted

Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?

The HKDF paper provides as good a summary as any: A Key derivation function (KDF) is a basic and essential component of cryptographic systems: Its goal is to take a source of initial keying material, ...
user avatar
29 votes
Accepted

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

The algorithms themselves just output binary (i.e. bytes) if you read their specifications. It's the implementation in API's and applications that output the hexadecimals and/or base64. Sometimes ...
user avatar
  • 85.8k
28 votes

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

Using Base64/HEX has nothing to do with security of a hash algorithm. Base64 and HEX are ways to represent binary data, which is the actual output of a hash algorithm. Base64 is shorter simple ...
user avatar
26 votes

What is the practical impact of using System.Random which is not cryptographically random?

From what you have described, it sounds like your system works as follows: Consult the system clock to find a 32-bit seed $s$. Use System.Random to generate a ...
user avatar
21 votes
Accepted

Can any MAC be used as a KDF?

No. A MAC guarantees unforgeability but not pseudorandomness. It is true that all MACs that I can think of right now are essential pseudorandom functions, but this does not mean that the MAC ...
user avatar
21 votes
Accepted

Why does Signal repeatedly hash the secure passphrase?

Cryptographic hashes are designed to be fast and collision resistant. It turns out that when hashing passwords, it is more secure to have a slow hash function. One way to make a fast hash function ...
user avatar
  • 37.8k
19 votes
Accepted

What exactly does s2k do in gpg

The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a ...
user avatar
19 votes
Accepted

Do I need to sanitize user input to scrypt, or to PBKDF's in general?

No, you do not need to do escaping or sanitization on data that you pass in as the user input to these functions. They accept arbitrary byte sequences, so any arbitrary byte sequence you pass is ...
user avatar
  • 1,657
18 votes

What is the practical impact of using System.Random which is not cryptographically random?

The official documentation for System.Random explicitly says it should not be used for generating passwords. It’s predictable, and seeded only from the system clock. This means System.Random has at ...
user avatar
  • 2,217
17 votes

Why does the FBI ask Apple for help to decrypt an iPhone?

The encryption key isn't derived only from the passcode; it's also derived from a number of cryptographic keys etched directly into the CPU's silicon. These keys are impossible to read out in software—...
user avatar
16 votes
Accepted

On AES, is a true random string enough for a key?

Even if the 32 characters are completely random, they won't contain non-printable characters. Actually, there are only about 107 printable characters in ASCII (out of 256 values for a full byte) and ...
user avatar
  • 85.8k
16 votes

Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?

KDF's or Key Derivation Functions are functions or schemes to derive key or output keying material (OKM) from other secret information, the input keying material (IKM). That information may be another ...
user avatar
  • 85.8k
16 votes
Accepted

Multiple AES Key Derivation from a master key

Multiple Key Generation from a Master key HMAC-based Key Derivation Function (HKDF) rfc5869 is what you are looking for. HMAC security proof uses the fact that the compression function of the ...
user avatar
  • 43.5k
15 votes
Accepted

How many KDF rounds for an SSH key?

I did also tried to find a good value for the -a flag, in a MacBook Pro Mid14 (i7), trying to login in to a Debian 8.5, I had this results: ...
user avatar
  • 282
15 votes
Accepted

Is deriving the IV from the password secure?

Yes, it is. PBKDF2 derives a DK, a "derived key", which is indistinguishable from random. This is mainly because function within PBKDF2 is HMAC, and HMAC is a PRF. Let's see the definition from ...
user avatar
  • 85.8k
15 votes
Accepted

Is SHA 2 suitable for key derivation?

In principle raw SHA2 is suitable for deriving an AES key from a DH shared secret. But the "proper" solution is to use a KDF. My preferred choice is HKDF, which can use SHA256 as the underlying hash ...
user avatar
  • 24.1k
15 votes

Is SHA 2 suitable for key derivation?

Yes. Actually any cryptographic hash function should be fine and allow you to reduce the problem of breaking your AES encryption to either: breaking your DH protocol, this follows from the fact that ...
user avatar
  • 7,266
14 votes

Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?

SHA-512 has both a larger internal state and a higher number of rounds than SHA-256 - which means that it provides a higher bit strength. Somewhat surprisingly it may also outperform SHA-256, as it ...
user avatar
  • 85.8k
13 votes

How many KDF rounds for an SSH key?

Slower is better, as slow as you can tolerate. Timing for different -a values, each measured 20 times: ...
user avatar
  • 1,406
13 votes
Accepted

Can any block cipher in CTR mode be used as a CSPRNG?

can any block cipher in CTR mode be used as a CSPRNG? Formally speaking the CTR mode transforms a PRF (or a PRP) into a PRG and as the PRP notion is the standard notion to model block ciphers, pretty ...
user avatar
  • 44.7k
13 votes
Accepted

Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?

Assume you have an IND-CCA secure cryptosystem $E$ that runs a password through a slow KDF and implicitly handles salts and random IVs, a human-chosen password $p$, and messages $m_1$ through $m_n$ to ...
user avatar
  • 13.5k
12 votes
Accepted

Deterministically generate a RSA public/private key pair from a passphrase (with sufficient entropy)?

Yes, it is possible to deterministically generate public/private RSA key pairs from passphrases. For even passable security, the passphrase must be processed by a key-stretching function, such as ...
user avatar
  • 125k
12 votes
Accepted

Questions about the argon2 options

The entire point of a key-derivation function like Argon2 is to increase the time (difficulty) it takes to create a key, and as a side effect, increase the resources required to attack the key. The ...
user avatar
12 votes

Why does Signal repeatedly hash the secure passphrase?

Am I correct in assuming that this does not add any extra security? No. This does add security and is a standard practice when dealing with passwords. What they do there is called a password hashing ...
user avatar
  • 44.7k
12 votes
Accepted

Relationship between PRF/KDF/MAC?

A key derivation function (KDF) takes in some secret keying material, which may or may not be uniformly distributed, and where the adversary may also have some auxiliary information about the keying ...
user avatar
  • 2,585
11 votes

Why don’t all AES encryption tools produce the same key from the same password?

There are two things here: Encryption uses mode of operation, and not "AES alone". Some of them are randomized by an initialization vector - that means the encryption of the same text under the same ...
user avatar
  • 12.3k

Only top scored, non community-wiki answers of a minimum length are eligible