New answers tagged

1

Fundamentally, there isn't, because there's way too few combinations. You can however look into some practical measures some systems use to mitigate weak PINs or passwords like these. One technique is to combine the PIN or weak passwords with a strong secret key that the user however is not required to memorize or manage. Perhaps most famous example is how ...


0

Yes, each LMS parameter sets can be used with any OTS parameter set. In the final NIST Recommendation for Stateful Hash-Based Signature Schemes there are even more parameters defined. Those calculations are correct but we do not need to store the entire LMS tree in memory. The solution is to store the seed for the RNG in the private key and calculate the ...


0

My educated-guess is no. Hashing could help only if original pin has low entropy, e.g. because maybe you digit with your thumb on a mobile phone and reaching some number on keyboard is easier than others... but brute-force success rate (that we could consider a lower bound to attacker's success rate) will never be lower than 1/(10^4)... so if you mean "...


3

The hash idea isn't great. See Kerckhoffs's principle. The underlying secret is still the four digit PIN, which is only $4 \times -\log_2(10) = 13$ bits of security. And don't we all pick '1234' anyway? You can use a key derivation function like Argon2 (there are others). That slows down hackers attempts at guessing your PIN. You could aim for something like ...


Top 50 recent answers are included