17
votes
Password hash that can be upgraded without plaintext password
This is called Client-Independent Update, according to the
Catena paper.
It is desirable to be able to compute a new password hash (with some higher security parameter) from the old one (with the ...
- 696
6
votes
Accepted
Key derivation on Arduino
Generally you should try and avoid deriving keys from passwords on embedded devices or passwords. There are a few strategies that could be used.
First of all, you can try and design a system that ...
- 93.9k
5
votes
Accepted
Is there a security risk associated with using a PBKDF for an AES encryption key and Sha256 for a hash using the same password text?
Yes, using a PBKDF and a SHA-256 hashing algorithm on the same password negates the usefulness of the PBKDF, by allowing to test a candidate password using a single hash; and (assuming unsalted ...
- 144k
5
votes
Accepted
Multiplication instead of Key Derivation Function?
Is it a risk to replace the use of a pbkdf function with a multiplication of the form S=J**K, creating a big number and only use the bits we need to exchange the only message that conversation needs ...
- 150k
5
votes
Accepted
PBKDF security if all but one keys are exposed
In case 3, one must consider that the knowledge of $salt_2$ and $k_2$ (or/and other ones) allows to test a guess of $pwd$ with about $c$ evaluations of $H$. The "brute force" attack becomes doing this ...
- 144k
4
votes
Key derivation on Arduino
There aren't many KDFs that will be faster on an AVR than PBKDF2. In your case, it's likely that the only thing you can do is find a hash which can be implemented efficiently on an ATmega2560, and ...
- 15.4k
4
votes
Encrypt a small amount of data with a password derived from PBKDF2
Is it fine to do that?
Yes, it should be fine, as long as you do not reuse the key/salt-pair for encrypting another piece of data.
Or is there a more standard construct?
Any authenticated ...
- 32.3k
4
votes
Accepted
Why does LastPass hash their passwords with PBKDF2 this way?
Can you explain what using PBKDF2 with 1 iteration is doing in the above?
Is this the same as just doing something like a HMAC SHA256 hash?
This is mostly HMAC-SHA256, but you can declare how ...
- 2,980
4
votes
Accepted
Is there an advantage to "weak" hashing and stretching over strong hashing?
The purpose of key stretching is to increase the strength of the resulting output keying material, compared with the input keying material. The input of the keying material is of course generally a ...
- 93.9k
3
votes
Key Derivation Function (KDF) usage for password storage
Yes and no, depending on what you mean by "storing passwords".
If you mean "storing my own passwords in a password store", then "no", since this is clearly not the goal ...
- 7,759
3
votes
Accepted
HMAC vs PKDBF2 as the first step towards HKDF
I don't think you get those "examples": they implement HKDF. The full name of HKDF is HMAC-based Extract-and-Expand Key Derivation Function. They do not use PBKDF2 because they don't ...
- 93.9k
3
votes
Accepted
PBKDF2 without salt on 16 digit password
TL;DR: If an attacker can gain less than 50k-100k USD from breaking all the "passwords" you're fine, else you could be screwed. (for 10k iterations, using SHA-1 for PBKDF-2)
How secure would be to ...
- 46.3k
3
votes
Accepted
PBKDF2 with the same salt for all IDs
Are there any security issues related to use the same SALT in PBKDF2 for all IDs?
Yes, you can build a rainbow table or brute force the ID's.
An attacker could build up a table with tokens. Once the ...
- 93.9k
3
votes
Function to derive an integer from a given password
If you have access to a PBKDF2 implementation, I'd just take a 8 byte output of PBKDF2. Whether that's a Little Endian or Big Endian value doesn't matter so long as you're consistent.
Since PBKDF2 ...
- 564
3
votes
Accepted
Generating passwords using Password-Based Key Derivation Function
Like I wrote in the comment, the method here is pretty similar. The differences:
Rather than deriving each site password directly from the password, I recommended deriving a single master secret ...
- 32.3k
3
votes
Memory-hard password-based key derivation functions?
Memory hard functions are designed so that the internal calculations rely on a relatively large state. The functions should not have shortcuts that allow an adversary to calculate the result without ...
- 93.9k
2
votes
Accepted
Function to derive an integer from a given password
Based on your code, it seems that the seed value you're deriving from the password is 64 bits long. This implies that:
due to the birthday paradox, you will likely see seed collisions after about 233 ...
- 46.4k
2
votes
Are there any high level memory-hard PBKDF constructions?
An alternative which appeared after the password hashing competition is Balloon hashing. It can use any standard cryptographic hash function as it's only crypto primitive; all other operations are ...
- 2,297
2
votes
Derive a key from a password and another key?
So the advantage of the keyfile in addition to the password is that it is basically a form of two factor authentication: You have a password (something you know), and a token (something you have).
...
- 19.8k
2
votes
Accepted
Is clientside encryption to hide data from server safe when using SSL?
Client-side encryption can prevent a passive eavesdropper on the server's memory—like Heartbleed—from seeing the client's secrets. But, if you might be concerned about any more serious compromise of ...
- 49.1k
1
vote
Question about PBKDF salts and cryptographically secure randomness
In cryptography books, a salt is defined as a random value, but it technically only needs to be unique. See, for instance, the Argon2 RFC:
The salt SHOULD be unique for each password.
The reason ...
- 2,060
1
vote
Is iterative sha256 adequate for local password manager?
I will skip the usual don't roll your own speech.
For a local password manager you typically need encryption not only password based key derivation.
You want to encrypt your various passwords with ...
- 11.9k
1
vote
Password hash that can be upgraded without plaintext password
Naively, I would say: can you not just concatenate both operations ? If you add a second hash operation of cost 10 to the existing hash, won't that give you a total cost of 20 ?
I mean: if CP is the ...
- 382
1
vote
Derive a key from a password and another key?
From what I understand, I should not be using the salt for this purpose, correct? I.e. I could use the salt as my "key file", and the password entered by the user as the password, but most literature ...
- 14.6k
1
vote
Accepted
Is there any use for PBKDF with empty password?
While it might be possible to use an empty password, the reason for that is most likely that any exclusion would also be known to the attacker.
However, I wouldn't call it an important test case. A ...
- 12.8k
Only top scored, non community-wiki answers of a minimum length are eligible