27
votes
Accepted
When to use Argon2i vs Argon2d vs Argon2id?
If you are unsure, then always choose Argon2id. Only choose Argon2d if you need maximum security at the expense of side-channel risk, and only choose Argon2i if side-channel attacks are the primary ...
- 15k
22
votes
Accepted
Is password-based AES encryption secure at all?
You are correct in that the best strategy for an adversary would be to guess the password, as opposed to cryptanalysis of AES plaintext/ciphertexts. However, this does not make encryption pointless - ...
- 19.5k
18
votes
How are recovery keys possible if something is encrypted using a password?
Conceptually, a recovery key is usually like a second password. The data is typically encrypted with a data encryption key and then the data encryption key is then encrypted twice, once with a key ...
- 2,013
18
votes
Accepted
Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw
You should not be hashing it before passing to bcrypt, which is designed to do the hashing and key-stretching work itself.
It's choking on the hash result because it's expecting a redundant, mushy, ...
17
votes
Accepted
Encrypting user data with their password?
There are a number of considerations here, I'll try to lay them out one at a time for ease of following:
What must the site do with the data?
Oftentimes, we ask web sites to do things on our behalf ...
- 285
16
votes
Accepted
Need for salt with IV
It sounds like you're using a password-based key derivation function that accepts an optional salt input to convert a passphrase into an encryption key, which you then use to encrypt messages with a ...
- 45.7k
14
votes
What's the difference between PBKDF2 and HMAC-SHA256 in security?
HMAC is still very efficient. It's used in PBKDF2 not for the lower efficiency (that's handled by iterating it many times) because of the fact that it takes two inputs. That lets the password and ...
- 5,716
13
votes
Is password-based AES encryption secure at all?
Am I right? Is it completely pointless to use passwords to AES encrypt files?
No, certainly it isn't completely pointless to use password to AES encrypt files. However, problem lies within details.
...
- 2,930
13
votes
Accepted
Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?
Assume you have an IND-CCA secure cryptosystem $E$ that runs a password through a slow KDF and implicitly handles salts and random IVs, a human-chosen password $p$, and messages $m_1$ through $m_n$ to ...
- 15k
12
votes
Accepted
How are recovery keys possible if something is encrypted using a password?
Adding a concrete example to Swashbuckler's correct answer:
When we talk of encryption, we talk of encrypting content with a key, not a password. Passwords are a specific kind of key, one that a user ...
- 3,231
11
votes
Accepted
Using a non-secure random generator for IV or salt generation
Let's take AES-CBC for example—a typical cryptosystem that requires a randomized IV. Suppose I can predict the IV in advance. Then I can start by asking for the encryption of $\mathit{iv}_0$, which ...
- 47.6k
9
votes
Length of encryption password aes-256-cbc
AES supports three key lengths. They are 128, 192 and 256 bits long. You chose to use the 256 bit algorithm that operates in CBC mode. It's a correct choice.
Now all you need is:
key - 256 bits long
...
- 677
9
votes
Is password-based AES encryption secure at all?
The short answer is, it depends on how you choose your passwords, and on how the software derives the encryption key from the password.
As you've correctly noted, AES is almost never the weakest link ...
- 45.7k
9
votes
Accepted
Is there any SRP-like key exchange only using "standard" cryptographic primitives?
The first protocol for password authenticated key exchange that appeared in the crypto community was the Bellovin-Merritt scheme (see also this survey page 4). This protocol is very simple, and might ...
- 18.9k
9
votes
Accepted
AES-256 password cracking time
It will happen immediately, because you just posted your password to the internet, where the adversary is watching.
On the other hand, if you can describe the procedure you used to generate it, we ...
- 47.6k
8
votes
Length of encryption password aes-256-cbc
Suppose you use 128 characters out of an alphabet (this is a large alphabet). To create a key you'd need about 37 fully random characters to create an AES key of 256 bit strength. Even you would ...
- 91.2k
8
votes
Accepted
Does encrypting data multiple times using different passwords increase security?
There is a terminology gap in your question. Lets assume that you want to encrypt message $m$, and for that purpose you'll be using the encryption function $E$ such that the encrypted message will be $...
- 271
8
votes
Accepted
Argon2 for both password storage and key derivation
Should the secret data be encrypted with Alice's raw password?
As a general rule of thumb:
A password should only ever be fed into a password hashing scheme (PHS) such as Argon2, scrypt or bcrypt, ...
- 45.6k
7
votes
Accepted
Recommended password complexity for SSH key encryption using AES-256-CBC
Both the AES key size and the RSA key size matter, because it's no use adding security beyond the weakest link. Here the weakest link is 2048-bit RSA, which is considered roughly equivalent in ...
- 31.9k
7
votes
Does encrypting data multiple times using different passwords increase security?
As mentioned in the comments, using two different algorithms with independent password does not "double" your security. Like in 3DES there would be a space time tradeoff for an attacker using a Meet-...
- 481
7
votes
What's the difference between PBKDF2 and HMAC-SHA256 in security?
What's the difference between PBKDF2 and HMAC-SHA256 in security?
PBKDF2 has a parameter c to slow it down, and that makes it suitable to turn a password into a ...
- 137k
6
votes
Accepted
Best way to generate a IV for AES-CBC when encrypting files?
Generate a random IV (with a cryptographically secure random generator of course) and prepend the IV to the ciphertext.
Some modes of encryption don't require a random IV, but you can never go wrong ...
6
votes
Is password-based AES encryption secure at all?
Am I right? Is it completely pointless to use passwords to AES encrypt files?
I'd say you're looking at it backwards. A better question would be: "Is it completely pointless to use AES to encrypt ...
- 14.4k
6
votes
Is there any SRP-like key exchange only using "standard" cryptographic primitives?
Building upon Geoffroy Couteau's answer, there are possible fixes to the issues addressed there.
The Bellovin-Merrit (from section 3: EKE using exponential key exchange) scheme is roughly like this:
-...
- 12.5k
6
votes
Accepted
Can key hardening compensate lack of entropy?
Yes. That's the entire idea of key stretching, you can get away with a password that offers less strength against attacks. You add more operations to a brute force/dictionary attack to protect the ...
- 91.2k
6
votes
Password-based cipher with fast encryption
One approach that you might consider is a puzzle; this is something where the decryptor must do some searching to find the result.
Here is one simple example: suppose the encryptor takes the password,...
- 143k
6
votes
Accepted
Does combining multiple PBKDF2 keys result higher iteration count when using same password but different salts?
By performing two PBKDF2 computations in parallel and combining the results, you're increasing the effort it would take an attacker to break the keys without increasing the amount of time it takes you ...
- 15k
5
votes
Best way to generate a IV for AES-CBC when encrypting files?
With AES-CBC you usually need a random IV. However, in the case where you use each key only once, like when using password-based encryption with random salts for each file, you can use a fixed, zero ...
- 31.9k
5
votes
Accepted
Are there any downsides to key stretching an already high quality entropic key?
Even with perfectly random input, if your final key size is 32 bytes, you cannot have more than 32 bytes of entropy in it.
But it seems pretty useless to use key stretching if you already have more ...
- 407
5
votes
Does encrypting data multiple times using different passwords increase security?
This question is similar. There we discussed and most people figured that its mostly a waste of time for some possible small increases in security. Mostly just use one longer password as the math is ...
- 912
Only top scored, non community-wiki answers of a minimum length are eligible