31
votes
Accepted
When to use Argon2i vs Argon2d vs Argon2id?
If you are unsure, then always choose Argon2id. Only choose Argon2d if you need maximum security at the expense of side-channel risk, and only choose Argon2i if side-channel attacks are the primary ...
- 15.5k
23
votes
Accepted
Is password-based AES encryption secure at all?
You are correct in that the best strategy for an adversary would be to guess the password, as opposed to cryptanalysis of AES plaintext/ciphertexts. However, this does not make encryption pointless - ...
- 19.9k
19
votes
How are recovery keys possible if something is encrypted using a password?
Conceptually, a recovery key is usually like a second password. The data is typically encrypted with a data encryption key and then the data encryption key is then encrypted twice, once with a key ...
- 2,118
18
votes
Accepted
Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw
You should not be hashing it before passing to bcrypt, which is designed to do the hashing and key-stretching work itself.
It's choking on the hash result because it's expecting a redundant, mushy, ...
14
votes
Is password-based AES encryption secure at all?
Am I right? Is it completely pointless to use passwords to AES encrypt files?
No, certainly it isn't completely pointless to use password to AES encrypt files. However, problem lies within details.
...
- 2,980
14
votes
What's the difference between PBKDF2 and HMAC-SHA256 in security?
HMAC is still very efficient. It's used in PBKDF2 not for the lower efficiency (that's handled by iterating it many times) because of the fact that it takes two inputs. That lets the password and ...
- 5,899
13
votes
Accepted
Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?
Assume you have an IND-CCA secure cryptosystem $E$ that runs a password through a slow KDF and implicitly handles salts and random IVs, a human-chosen password $p$, and messages $m_1$ through $m_n$ to ...
- 15.5k
13
votes
Accepted
How are recovery keys possible if something is encrypted using a password?
Adding a concrete example to Swashbuckler's correct answer:
When we talk of encryption, we talk of encrypting content with a key, not a password. Passwords are a specific kind of key, one that a user ...
- 3,281
11
votes
Accepted
Using a non-secure random generator for IV or salt generation
Let's take AES-CBC for example—a typical cryptosystem that requires a randomized IV. Suppose I can predict the IV in advance. Then I can start by asking for the encryption of $\mathit{iv}_0$, which ...
- 49.5k
10
votes
Is password-based AES encryption secure at all?
The short answer is, it depends on how you choose your passwords, and on how the software derives the encryption key from the password.
As you've correctly noted, AES is almost never the weakest link ...
- 46.5k
9
votes
Accepted
Is there any SRP-like key exchange only using "standard" cryptographic primitives?
The first protocol for password authenticated key exchange that appeared in the crypto community was the Bellovin-Merritt scheme (see also this survey page 4). This protocol is very simple, and might ...
- 21.3k
9
votes
Accepted
AES-256 password cracking time
It will happen immediately, because you just posted your password to the internet, where the adversary is watching.
On the other hand, if you can describe the procedure you used to generate it, we ...
- 49.5k
8
votes
Accepted
Does encrypting data multiple times using different passwords increase security?
There is a terminology gap in your question. Lets assume that you want to encrypt message $m$, and for that purpose you'll be using the encryption function $E$ such that the encrypted message will be $...
- 271
8
votes
What's the difference between PBKDF2 and HMAC-SHA256 in security?
What's the difference between PBKDF2 and HMAC-SHA256 in security?
PBKDF2 has a parameter c to slow it down, and that makes it suitable to turn a password into a ...
- 145k
8
votes
Accepted
Argon2 for both password storage and key derivation
Should the secret data be encrypted with Alice's raw password?
As a general rule of thumb:
A password should only ever be fed into a password hashing scheme (PHS) such as Argon2, scrypt or bcrypt, ...
- 46.4k
7
votes
Does encrypting data multiple times using different passwords increase security?
As mentioned in the comments, using two different algorithms with independent password does not "double" your security. Like in 3DES there would be a space time tradeoff for an attacker using a Meet-...
- 481
6
votes
Accepted
Can key hardening compensate lack of entropy?
Yes. That's the entire idea of key stretching, you can get away with a password that offers less strength against attacks. You add more operations to a brute force/dictionary attack to protect the ...
- 94.5k
6
votes
Is there any SRP-like key exchange only using "standard" cryptographic primitives?
Building upon Geoffroy Couteau's answer, there are possible fixes to the issues addressed there.
The Bellovin-Merrit (from section 3: EKE using exponential key exchange) scheme is roughly like this:
-...
- 12.8k
6
votes
Is password-based AES encryption secure at all?
Am I right? Is it completely pointless to use passwords to AES encrypt files?
I'd say you're looking at it backwards. A better question would be: "Is it completely pointless to use AES to encrypt ...
- 14.7k
6
votes
Password-based cipher with fast encryption
One approach that you might consider is a puzzle; this is something where the decryptor must do some searching to find the result.
Here is one simple example: suppose the encryptor takes the password,...
- 151k
6
votes
What's the difference between PBKDF2 and HMAC-SHA256 in security?
HMAC-SHA-256 with a static key is actually about as efficient as just SHA-256. Yes, it uses SHA-256 twice, but with a given key a lot of pre-computation can be performed.
PBKDF2 relies on the ...
- 94.5k
6
votes
Accepted
Does combining multiple PBKDF2 keys result higher iteration count when using same password but different salts?
By performing two PBKDF2 computations in parallel and combining the results, you're increasing the effort it would take an attacker to break the keys without increasing the amount of time it takes you ...
- 15.5k
5
votes
Accepted
Can a Password be Derived from a AES key?
Given an AES key, lets say an AES-256 key which is derived from a user password, is there any way to analyze the key and reverse engineer the password used to generate the key?
This is really the ...
- 14.7k
5
votes
How important is length and complexity of personal password for AES-256 encryption?
AES is a block cipher. FIPS 197 - the standard that defines AES - doesn't specify anything with regards to passwords - it just discusses AES using keys.
There are other protocols that do specify ...
- 94.5k
5
votes
Accepted
Are there any downsides to key stretching an already high quality entropic key?
Even with perfectly random input, if your final key size is 32 bytes, you cannot have more than 32 bytes of entropy in it.
But it seems pretty useless to use key stretching if you already have more ...
- 407
5
votes
Does encrypting data multiple times using different passwords increase security?
This question is similar. There we discussed and most people figured that its mostly a waste of time for some possible small increases in security. Mostly just use one longer password as the math is ...
- 912
5
votes
Accepted
Does AES-GCM without security tag turn into regular CTR Mode?
I'll keep to the final question as security evaluating the entire scheme would be off topic:
If we use the implemented AES-GCM mode but without security tag (TAG_SIZE 0 bit) does this make the ...
- 94.5k
5
votes
Why cryptsetup default KDF is PBKDF2 and not Argon2(id)?
The default version of LUKS simply does not support Argon2 because, unlike PBKDF2, it requires more parameters than the current header format is designed to store. The newer version, LUKS2, may not be ...
- 15.5k
5
votes
How passwords are fed to key derivation functions?
You are correct: generally it is required to synchronize or otherwise synchronize information if you want to use a password based key derivation function (PBKDF) for sending messages.
That doesn't ...
- 94.5k
4
votes
UNIX password scheme and encryption function
Most people would not call what we do to store passwords encryption as it is not reversible. It's a cryptographic hash.
Also the diagram has some specific numbers which correspond to the orignal unix ...
- 12k
Only top scored, non community-wiki answers of a minimum length are eligible