Skip to main content
17 votes

Password hash that can be upgraded without plaintext password

This is called Client-Independent Update, according to the Catena paper. It is desirable to be able to compute a new password hash (with some higher security parameter) from the old one (with the ...
Sjoerd's user avatar
  • 661
6 votes
Accepted

What are KDF parameters in OpenSSL command-line utility for `enc`?

OpenSSL uses EVP_BytesToKey, an algorithm proprietary to OpenSSL, with a salt and an iteration count set to 1. The algorithm is secure; the iteration count of 1 of ...
Maarten Bodewes's user avatar
  • 92.7k
6 votes
Accepted

Key derivation on Arduino

Generally you should try and avoid deriving keys from passwords on embedded devices or passwords. There are a few strategies that could be used. First of all, you can try and design a system that ...
Maarten Bodewes's user avatar
  • 92.7k
5 votes
Accepted

Multiplication instead of Key Derivation Function?

Is it a risk to replace the use of a pbkdf function with a multiplication of the form S=J**K, creating a big number and only use the bits we need to exchange the only message that conversation needs ...
poncho's user avatar
  • 147k
5 votes
Accepted

PBKDF security if all but one keys are exposed

In case 3, one must consider that the knowledge of $salt_2$ and $k_2$ (or/and other ones) allows to test a guess of $pwd$ with about $c$ evaluations of $H$. The "brute force" attack becomes doing this ...
fgrieu's user avatar
  • 141k
5 votes
Accepted

Is there a security risk associated with using a PBKDF for an AES encryption key and Sha256 for a hash using the same password text?

Yes, using a PBKDF and a SHA-256 hashing algorithm on the same password negates the usefulness of the PBKDF, by allowing to test a candidate password using a single hash; and (assuming unsalted ...
fgrieu's user avatar
  • 141k
5 votes

Are there any high level memory-hard PBKDF constructions?

Are there any memory-hard PBKDF constructions that can be implemented using only common standard crypto primitives, like (generic) hash functions and/or block ciphers? Of course there is one, and ...
SEJPM's user avatar
  • 46k
5 votes

What are KDF parameters in OpenSSL command-line utility for `enc`?

For full explanation, see Is there a standard for OpenSSL-interoperable AES encryption? . Short answer: what openssl enc (without ...
dave_thompson_085's user avatar
4 votes

Encrypt a small amount of data with a password derived from PBKDF2

Is it fine to do that? Yes, it should be fine, as long as you do not reuse the key/salt-pair for encrypting another piece of data. Or is there a more standard construct? Any authenticated ...
otus's user avatar
  • 32.1k
4 votes
Accepted

Why does LastPass hash their passwords with PBKDF2 this way?

Can you explain what using PBKDF2 with 1 iteration is doing in the above? Is this the same as just doing something like a HMAC SHA256 hash? This is mostly HMAC-SHA256, but you can declare how ...
axapaxa's user avatar
  • 2,940
4 votes

Key derivation on Arduino

There aren't many KDFs that will be faster on an AVR than PBKDF2. In your case, it's likely that the only thing you can do is find a hash which can be implemented efficiently on an ATmega2560, and ...
forest's user avatar
  • 15.3k
4 votes
Accepted

Is there an advantage to "weak" hashing and stretching over strong hashing?

The purpose of key stretching is to increase the strength of the resulting output keying material, compared with the input keying material. The input of the keying material is of course generally a ...
Maarten Bodewes's user avatar
  • 92.7k
3 votes

Key Derivation Function (KDF) usage for password storage

Yes and no, depending on what you mean by "storing passwords". If you mean "storing my own passwords in a password store", then "no", since this is clearly not the goal ...
Lery's user avatar
  • 7,679
3 votes
Accepted

HMAC vs PKDBF2 as the first step towards HKDF

I don't think you get those "examples": they implement HKDF. The full name of HKDF is HMAC-based Extract-and-Expand Key Derivation Function. They do not use PBKDF2 because they don't ...
Maarten Bodewes's user avatar
  • 92.7k
3 votes

Function to derive an integer from a given password

If you have access to a PBKDF2 implementation, I'd just take a 8 byte output of PBKDF2. Whether that's a Little Endian or Big Endian value doesn't matter so long as you're consistent. Since PBKDF2 ...
bartonjs's user avatar
  • 564
3 votes
Accepted

Generating passwords using Password-Based Key Derivation Function

Like I wrote in the comment, the method here is pretty similar. The differences: Rather than deriving each site password directly from the password, I recommended deriving a single master secret ...
otus's user avatar
  • 32.1k
3 votes

Memory-hard password-based key derivation functions?

Memory hard functions are designed so that the internal calculations rely on a relatively large state. The functions should not have shortcuts that allow an adversary to calculate the result without ...
Maarten Bodewes's user avatar
  • 92.7k
3 votes
Accepted

PBKDF2 without salt on 16 digit password

TL;DR: If an attacker can gain less than 50k-100k USD from breaking all the "passwords" you're fine, else you could be screwed. (for 10k iterations, using SHA-1 for PBKDF-2) How secure would be to ...
SEJPM's user avatar
  • 46k
3 votes
Accepted

PBKDF2 with the same salt for all IDs

Are there any security issues related to use the same SALT in PBKDF2 for all IDs? Yes, you can build a rainbow table or brute force the ID's. An attacker could build up a table with tokens. Once the ...
Maarten Bodewes's user avatar
  • 92.7k
2 votes

Are there any high level memory-hard PBKDF constructions?

An alternative which appeared after the password hashing competition is Balloon hashing. It can use any standard cryptographic hash function as it's only crypto primitive; all other operations are ...
rmalayter's user avatar
  • 2,297
2 votes

Encryption strength when using a PBKDF

Actually, the strength of the derived key is likely to be limited by the strength of the password; for example, if the user selects the password "password", well, that's likely be to within the first ...
poncho's user avatar
  • 147k
2 votes
Accepted

Function to derive an integer from a given password

Based on your code, it seems that the seed value you're deriving from the password is 64 bits long. This implies that: due to the birthday paradox, you will likely see seed collisions after about 233 ...
Ilmari Karonen's user avatar
2 votes

Derive a key from a password and another key?

So the advantage of the keyfile in addition to the password is that it is basically a form of two factor authentication: You have a password (something you know), and a token (something you have). ...
Ella Rose's user avatar
  • 19.6k
2 votes
Accepted

Is clientside encryption to hide data from server safe when using SSL?

Client-side encryption can prevent a passive eavesdropper on the server's memory—like Heartbleed—from seeing the client's secrets. But, if you might be concerned about any more serious compromise of ...
Squeamish Ossifrage's user avatar
1 vote

Question about PBKDF salts and cryptographically secure randomness

In cryptography books, a salt is defined as a random value, but it technically only needs to be unique. See, for instance, the Argon2 RFC: The salt SHOULD be unique for each password. The reason ...
samuel-lucas6's user avatar
1 vote

Is iterative sha256 adequate for local password manager?

I will skip the usual don't roll your own speech. For a local password manager you typically need encryption not only password based key derivation. You want to encrypt your various passwords with ...
Meir Maor's user avatar
  • 11.8k
1 vote

Password hash that can be upgraded without plaintext password

Naively, I would say: can you not just concatenate both operations ? If you add a second hash operation of cost 10 to the existing hash, won't that give you a total cost of 20 ? I mean: if CP is the ...
entrop-x's user avatar
  • 372
1 vote

Derive a key from a password and another key?

From what I understand, I should not be using the salt for this purpose, correct? I.e. I could use the salt as my "key file", and the password entered by the user as the password, but most literature ...
Luis Casillas's user avatar
1 vote
Accepted

Is there any use for PBKDF with empty password?

While it might be possible to use an empty password, the reason for that is most likely that any exclusion would also be known to the attacker. However, I wouldn't call it an important test case. A ...
tylo's user avatar
  • 12.7k

Only top scored, non community-wiki answers of a minimum length are eligible