Skip to main content
31 votes
Accepted

When to use Argon2i vs Argon2d vs Argon2id?

If you are unsure, then always choose Argon2id. Only choose Argon2d if you need maximum security at the expense of side-channel risk, and only choose Argon2i if side-channel attacks are the primary ...
forest's user avatar
  • 15.4k
23 votes
Accepted

Is password-based AES encryption secure at all?

You are correct in that the best strategy for an adversary would be to guess the password, as opposed to cryptanalysis of AES plaintext/ciphertexts. However, this does not make encryption pointless - ...
Ella Rose's user avatar
  • 19.7k
19 votes

How are recovery keys possible if something is encrypted using a password?

Conceptually, a recovery key is usually like a second password. The data is typically encrypted with a data encryption key and then the data encryption key is then encrypted twice, once with a key ...
Swashbuckler's user avatar
  • 2,098
18 votes
Accepted

Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw

You should not be hashing it before passing to bcrypt, which is designed to do the hashing and key-stretching work itself. It's choking on the hash result because it's expecting a redundant, mushy, ...
JamesTheAwesomeDude's user avatar
17 votes
Accepted

Encrypting user data with their password?

There are a number of considerations here, I'll try to lay them out one at a time for ease of following: What must the site do with the data? Oftentimes, we ask web sites to do things on our behalf ...
HedgeMage's user avatar
  • 285
14 votes

Is password-based AES encryption secure at all?

Am I right? Is it completely pointless to use passwords to AES encrypt files? No, certainly it isn't completely pointless to use password to AES encrypt files. However, problem lies within details. ...
axapaxa's user avatar
  • 2,960
14 votes

What's the difference between PBKDF2 and HMAC-SHA256 in security?

HMAC is still very efficient. It's used in PBKDF2 not for the lower efficiency (that's handled by iterating it many times) because of the fact that it takes two inputs. That lets the password and ...
SAI Peregrinus's user avatar
13 votes
Accepted

Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?

Assume you have an IND-CCA secure cryptosystem $E$ that runs a password through a slow KDF and implicitly handles salts and random IVs, a human-chosen password $p$, and messages $m_1$ through $m_n$ to ...
forest's user avatar
  • 15.4k
13 votes
Accepted

How are recovery keys possible if something is encrypted using a password?

Adding a concrete example to Swashbuckler's correct answer: When we talk of encryption, we talk of encrypting content with a key, not a password. Passwords are a specific kind of key, one that a user ...
Cort Ammon's user avatar
  • 3,271
11 votes
Accepted

Using a non-secure random generator for IV or salt generation

Let's take AES-CBC for example—a typical cryptosystem that requires a randomized IV. Suppose I can predict the IV in advance. Then I can start by asking for the encryption of $\mathit{iv}_0$, which ...
Squeamish Ossifrage's user avatar
10 votes

Is password-based AES encryption secure at all?

The short answer is, it depends on how you choose your passwords, and on how the software derives the encryption key from the password. As you've correctly noted, AES is almost never the weakest link ...
Ilmari Karonen's user avatar
9 votes
Accepted

Is there any SRP-like key exchange only using "standard" cryptographic primitives?

The first protocol for password authenticated key exchange that appeared in the crypto community was the Bellovin-Merritt scheme (see also this survey page 4). This protocol is very simple, and might ...
Geoffroy Couteau's user avatar
9 votes
Accepted

AES-256 password cracking time

It will happen immediately, because you just posted your password to the internet, where the adversary is watching. On the other hand, if you can describe the procedure you used to generate it, we ...
Squeamish Ossifrage's user avatar
8 votes
Accepted

Does encrypting data multiple times using different passwords increase security?

There is a terminology gap in your question. Lets assume that you want to encrypt message $m$, and for that purpose you'll be using the encryption function $E$ such that the encrypted message will be $...
stromboli's user avatar
  • 271
8 votes
Accepted

Argon2 for both password storage and key derivation

Should the secret data be encrypted with Alice's raw password? As a general rule of thumb: A password should only ever be fed into a password hashing scheme (PHS) such as Argon2, scrypt or bcrypt, ...
SEJPM's user avatar
  • 46.2k
7 votes

Does encrypting data multiple times using different passwords increase security?

As mentioned in the comments, using two different algorithms with independent password does not "double" your security. Like in 3DES there would be a space time tradeoff for an attacker using a Meet-...
raisyn's user avatar
  • 481
7 votes

What's the difference between PBKDF2 and HMAC-SHA256 in security?

What's the difference between PBKDF2 and HMAC-SHA256 in security? PBKDF2 has a parameter c to slow it down, and that makes it suitable to turn a password into a ...
fgrieu's user avatar
  • 142k
6 votes
Accepted

Best way to generate a IV for AES-CBC when encrypting files?

Generate a random IV (with a cryptographically secure random generator of course) and prepend the IV to the ciphertext. Some modes of encryption don't require a random IV, but you can never go wrong ...
Gilles 'SO- stop being evil''s user avatar
6 votes

Is password-based AES encryption secure at all?

Am I right? Is it completely pointless to use passwords to AES encrypt files? I'd say you're looking at it backwards. A better question would be: "Is it completely pointless to use AES to encrypt ...
Luis Casillas's user avatar
6 votes
Accepted

Can key hardening compensate lack of entropy?

Yes. That's the entire idea of key stretching, you can get away with a password that offers less strength against attacks. You add more operations to a brute force/dictionary attack to protect the ...
Maarten Bodewes's user avatar
  • 93.4k
6 votes

Is there any SRP-like key exchange only using "standard" cryptographic primitives?

Building upon Geoffroy Couteau's answer, there are possible fixes to the issues addressed there. The Bellovin-Merrit (from section 3: EKE using exponential key exchange) scheme is roughly like this: -...
tylo's user avatar
  • 12.7k
6 votes

Password-based cipher with fast encryption

One approach that you might consider is a puzzle; this is something where the decryptor must do some searching to find the result. Here is one simple example: suppose the encryptor takes the password,...
poncho's user avatar
  • 148k
6 votes
Accepted

Does combining multiple PBKDF2 keys result higher iteration count when using same password but different salts?

By performing two PBKDF2 computations in parallel and combining the results, you're increasing the effort it would take an attacker to break the keys without increasing the amount of time it takes you ...
forest's user avatar
  • 15.4k
5 votes
Accepted

Are there any downsides to key stretching an already high quality entropic key?

Even with perfectly random input, if your final key size is 32 bytes, you cannot have more than 32 bytes of entropy in it. But it seems pretty useless to use key stretching if you already have more ...
Dillinur's user avatar
  • 407
5 votes

Best way to generate a IV for AES-CBC when encrypting files?

With AES-CBC you usually need a random IV. However, in the case where you use each key only once, like when using password-based encryption with random salts for each file, you can use a fixed, zero ...
otus's user avatar
  • 32.2k
5 votes

Does encrypting data multiple times using different passwords increase security?

This question is similar. There we discussed and most people figured that its mostly a waste of time for some possible small increases in security. Mostly just use one longer password as the math is ...
daniel's user avatar
  • 912
5 votes

How important is length and complexity of personal password for AES-256 encryption?

AES is a block cipher. FIPS 197 - the standard that defines AES - doesn't specify anything with regards to passwords - it just discusses AES using keys. There are other protocols that do specify ...
Maarten Bodewes's user avatar
  • 93.4k
5 votes
Accepted

Can a Password be Derived from a AES key?

Given an AES key, lets say an AES-256 key which is derived from a user password, is there any way to analyze the key and reverse engineer the password used to generate the key? This is really the ...
Luis Casillas's user avatar
5 votes

What's the difference between PBKDF2 and HMAC-SHA256 in security?

HMAC-SHA-256 with a static key is actually about as efficient as just SHA-256. Yes, it uses SHA-256 twice, but with a given key a lot of pre-computation can be performed. PBKDF2 relies on the ...
Maarten Bodewes's user avatar
  • 93.4k
5 votes

Why cryptsetup default KDF is PBKDF2 and not Argon2(id)?

The default version of LUKS simply does not support Argon2 because, unlike PBKDF2, it requires more parameters than the current header format is designed to store. The newer version, LUKS2, may not be ...
forest's user avatar
  • 15.4k

Only top scored, non community-wiki answers of a minimum length are eligible