Hot answers tagged

26 votes
Accepted

What's the difference between PBKDF and SHA and why use them together?

SHA-512 is a cryptographically secure hash, PBKDF2 is what we call a Password Based Key Derivation Function. If the resulting secret isn't used as key but as hash value it's also called a password ...
Maarten Bodewes's user avatar
  • 91.7k
19 votes
Accepted

Do I need to sanitize user input to scrypt, or to PBKDF's in general?

No, you do not need to do escaping or sanitization on data that you pass in as the user input to these functions. They accept arbitrary byte sequences, so any arbitrary byte sequence you pass is ...
bk2204's user avatar
  • 2,971
18 votes

What's the difference between PBKDF and SHA and why use them together?

To paraphrase my answer to an earlier question, PBKDF2 is a generic high-level algorithm that internally calls a pseudorandom function (PRF) to process its input. The PBKDF2 spec does not mandate any ...
Ilmari Karonen's user avatar
18 votes

Password hash that can be upgraded without plaintext password

This is called Client-Independent Update, according to the Catena paper. It is desirable to be able to compute a new password hash (with some higher security parameter) from the old one (with the ...
Sjoerd's user avatar
  • 641
15 votes
Accepted

Is deriving the IV from the password secure?

Yes, it is. PBKDF2 derives a DK, a "derived key", which is indistinguishable from random. This is mainly because function within PBKDF2 is HMAC, and HMAC is a PRF. Let's see the definition from ...
Maarten Bodewes's user avatar
  • 91.7k
13 votes
Accepted

Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?

Assume you have an IND-CCA secure cryptosystem $E$ that runs a password through a slow KDF and implicitly handles salts and random IVs, a human-chosen password $p$, and messages $m_1$ through $m_n$ to ...
forest's user avatar
  • 15.1k
10 votes
Accepted

Does a big salt have the same memory effects as Bcrypt?

So in general, isn't this equivalent to what Bcrypt and PBKDF2 do in terms of password storage security? PBKDF2, yes, pretty much. The only real difference is that salt/password are used the other ...
otus's user avatar
  • 32k
10 votes
Accepted

Argon2i versus Argon2d?

TL;DR: You want to use Argon2d here. Even though Argon2 was standardized only somewhat recently, it is the result of the Password-Hashing Competition (2013-2015) and was a late re-design of Argon ...
SEJPM's user avatar
  • 45.7k
9 votes
Accepted

Is PBKDF2/RFC 2898 broken because SHA1 is broken?

That particular usage of SHA-1 uses HMAC, and then iterates that as part of PBKDF2 (which is actually defined for any PRF, not just HMAC-SHA1). As of this date (2017-05-18) HMAC-SHA1 is unbroken in ...
rmalayter's user avatar
  • 2,287
9 votes
Accepted

Is it necessary to stretch/derive an AES key when I already have enough bytes from a 'cryptographically secure RNG'?

You're right. Unless the software is doing something very peculiar, which should be very apparent when reading the code and documentation, and I can't imagine what it could be, the salt generation and ...
Gilles 'SO- stop being evil''s user avatar
8 votes
Accepted

Can I use PBKDF2 as a stream cipher?

TL;DR: Yes, you can use PBKDF2 as a stream cipher. However, you should not use it for that and for its intended purpose (i.e. password-based key derivation) at the same time. Instead, if you need to ...
Ilmari Karonen's user avatar
8 votes
Accepted

Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?

Background. PBKDF2 has a stupid design where generating two blocks of output costs the legitimate user twice as much as generating one block of output, without necessarily putting additional cost on ...
Squeamish Ossifrage's user avatar
8 votes

The logic of preferring PBKDF2 over iterative SHA2

I think you are overstating the complexity of PBKDF2, and also, not matching it feature-wise with your alternative. Let's dispatch the latter first: as gammatester's comment mentioned, PBKDF2 ...
Luis Casillas's user avatar
7 votes
Accepted

Some Questions about the Veracrypt hash functions

These hash functions are also used for the key derivation function. Both are roughly equally secure for a KDF in the sense of collision resistance etc., but SHA512 offers a bit more security as ...
BeloumiX's user avatar
  • 985
7 votes
Accepted

Is it safe to store both the AES-related data and the PBKDF2-related data (except passwords) in one file?

All the parameters you've mentioned can be public. Furthermore, only the salt, IV and ciphertext cannot simply be guessed. The IV is generally easy to retrieve once the key is known, so the making ...
Maarten Bodewes's user avatar
  • 91.7k
7 votes

I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error

There's no point in using either an ASIC or a GPU to calculate a single password hash. That's true whether you use PBKDF2 or scrypt or Argon2 or whatever. What massively parallel devices like GPUs ...
Ilmari Karonen's user avatar
7 votes

Meaning of the term "Key Material"

Key material is the “mathematical” key, as opposed to metadata about the key such as the key type, its name in a database, its usage policy, etc. In the context of key management, and in particular ...
Gilles 'SO- stop being evil''s user avatar
6 votes
Accepted

What are KDF parameters in OpenSSL command-line utility for `enc`?

OpenSSL uses EVP_BytesToKey, an algorithm proprietary to OpenSSL, with a salt and an iteration count set to 1. The algorithm is secure; the iteration count of 1 of ...
Maarten Bodewes's user avatar
  • 91.7k
6 votes
Accepted

Deriving a key for HMAC, using PBKDF2

No, you should not use a password directly as an HMAC key. However, it is fine to use HMAC as part of a key derivation function, which generates keys from a password. However, do not mistake the ...
Richie Frame's user avatar
6 votes
Accepted

WPA/WPA2 Handshake -- Why are Nonces not encrypted?

Unfortunately, that wouldn't really achieve much. To see why, let's first recall the steps of the common dictionary attack on WPA/WPA2-PSK. In WPA/WPA2-PSK, the key hierarchy goes like this: ...
hakoja's user avatar
  • 2,695
6 votes
Accepted

HMACSHA1 vs HMACSHA2 (for PBKDF2)

The only downside to SHA-2 over SHA-1 is that SHA-2 is a little slower. In this case, that is of no practical consequence whatsoever because you're trying to make something slow to compute, and it is ...
Squeamish Ossifrage's user avatar
6 votes
Accepted

How many bits of entropy are leaked for every derived password from a master?

From an information-theoretic perspective, and with an ideal password hash function, with $k=68$ possibilities for each character of derived password, each such character leaks about $\log_2(k)\...
fgrieu's user avatar
  • 138k
6 votes

I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error

The question correctly finds that In the case of PBKDF2, you will need to buy an ASIC to be ideal and proceeds assuming the legitimate server does that; or at least, uses a GPU as substitute. ...
fgrieu's user avatar
  • 138k
6 votes
Accepted

Using a KDF (PBKDF2) properly

PBKDF2 is deliberately slow (and gets slower and safer with more iterations, so you want to make it as slow as you practically can). Because of this, you should generally avoid running it more times ...
Ilmari Karonen's user avatar
6 votes
Accepted

Line by line encrypted logging stored with iv/salt/iterations. How safe is it?

Is it safe to store all of that information at the same place? All the information (salt, pbkdf2, iterations, iv, GCM tag, encrypted payload) is listed can be considered as public information. We ...
kelalaka's user avatar
  • 47.6k
6 votes

Generate AES key from weak string

You need a key stretching function, not a mere key derivation function. A key stretching function is technically a kind of key derivation function, but most key derivation functions are not key ...
Gilles 'SO- stop being evil''s user avatar
6 votes
Accepted

Does combining multiple PBKDF2 keys result higher iteration count when using same password but different salts?

By performing two PBKDF2 computations in parallel and combining the results, you're increasing the effort it would take an attacker to break the keys without increasing the amount of time it takes you ...
forest's user avatar
  • 15.1k
5 votes

What are KDF parameters in OpenSSL command-line utility for `enc`?

For full explanation, see Is there a standard for OpenSSL-interoperable AES encryption? . Short answer: what openssl enc (without ...
dave_thompson_085's user avatar
5 votes
Accepted

Are shorter password hashes safe?

My intuition suggests that there would be no security impact if this output were truncated to 128 bits. Is this correct? My reasoning here is that salting prevents multi-target attacks, and that ...
otus's user avatar
  • 32k
5 votes
Accepted

PBKDF2 PRF: HMAC or just hash?

HMAC is sometimes called a keyed hash. The key is not part of the input of a secure hash (as CodesInChaos already indicated in the comments). HMAC is a relatively simple construct to allow a key to be ...
Maarten Bodewes's user avatar
  • 91.7k

Only top scored, non community-wiki answers of a minimum length are eligible