New answers tagged pbkdf-2
7
You're right. Unless the software is doing something very peculiar, which should be very apparent when reading the code and documentation, and I can't imagine what it could be, the salt generation and the application of PBKDF2 are unnecessary.
If you have 32 bytes from a cryptographically secure random generator, you can use these 32 bytes as an AES-256 key....
answered May 12 at 9:23
Gilles 'SO- stop being evil'
12.4k3 gold badges34 silver badges65 bronze badges
1
Key material is the “mathematical” key, as opposed to metadata about the key such as the key type, its name in a database, its usage policy, etc.
In the context of key management, and in particular of programming interfaces that manipulate cryptographic keys, the term key can mean multiple things. It can refer to the actual bytes or numbers that are used in ...
answered May 8 at 16:15
Gilles 'SO- stop being evil'
12.4k3 gold badges34 silver badges65 bronze badges
0
It is impossible to give a definitive answer given missing context, I believe however I can provide some useful information from my own lecture of cryptography-related literature.
As I believe most people understand it, when the difference is made between a key and key material, the former refers to a cryptographic key in a given format as can be readily ...
0
If the customer sends his public key to the business, then the business creates a new set of keys forwarding the new public key to the visitor then the business now has a way to decrypt messages from the visitor since the visitor is not aware that the public key is not the intended customers public key but the new one generated by the business. The business ...
0
If you're thinking along the lines of keeping the salt secret, then it sounds like you may want your users to provide a second factor at time of authentication (ie. 'something you have' and 'something you know').
If the user's device is a phone, and your login screen is a phone-app, then the 'salt' 2nd-factor could be a QRcode that gets scanned by the user ...
0
Since he isn't yet authenticated, how can I trust those who ask me for this salt? Because if I gave it to anyone who asks for it, it wouldn't make sense to use it.
That's where you went wrong. Salts are public: their purpose is to be unique per derived key, not to be secret. The security analysis of the KDF must assume that any salt used is public, so ...
Top 50 recent answers are included
