Skip to main content
33 votes
Accepted

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

The algorithms themselves just output binary (i.e. bytes) if you read their specifications. It's the implementation in API's and applications that output the hexadecimals and/or base64. Sometimes ...
Maarten Bodewes's user avatar
  • 93.2k
29 votes

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

Using Base64/HEX has nothing to do with security of a hash algorithm. Base64 and HEX are ways to represent binary data, which is the actual output of a hash algorithm. Base64 is shorter simple ...
DDoSolitary's user avatar
19 votes
Accepted

Do I need to sanitize user input to scrypt, or to PBKDF's in general?

No, you do not need to do escaping or sanitization on data that you pass in as the user input to these functions. They accept arbitrary byte sequences, so any arbitrary byte sequence you pass is ...
bk2204's user avatar
  • 3,476
15 votes
Accepted

Appropriate scrypt parameters when generating an scrypt hash

$r$ determines the sequential read size. This should only be changed if you have custom hardware that has a memory subsystem with different characteristics. It takes time to pull data from main memory,...
Nick Bauer's user avatar
14 votes
Accepted

Should I use SHA256 or Blake2 to checksum and sign scrypt headers?

Note that Blake2's security goals are a superset of those of SHA-256: SHA-256 is conjectured to be collision resistant, preimage resistant and second preimage resistant. Blake2 is conjectured to be ...
Luis Casillas's user avatar
12 votes

Password Hashing Security Using Scrypt & Argon2

This home-made construction is pointless and unnecessarily complex, Complexity is often the source of vulnerabilities. In this case, for example, I’ll wager you’re not securely handling the ...
rmalayter's user avatar
  • 2,297
7 votes
Accepted

argon2 vs scrypt

As far as I read, scrypt can be used for some time/memory tradeoffs where you save memory but take more computations, which may truly be an annoying thing. Argon2d uses data dependent on the input (i....
My1's user avatar
  • 330
7 votes

I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error

There's no point in using either an ASIC or a GPU to calculate a single password hash. That's true whether you use PBKDF2 or scrypt or Argon2 or whatever. What massively parallel devices like GPUs ...
Ilmari Karonen's user avatar
7 votes

Password Hashing Security Using Scrypt & Argon2

You are using the KDF wrong. The only purpose of Argon2 and scrypt (and related constructions like bcrypt and PBKDF2) is to slow down dictionary and brute force attacks against passwords created by ...
forest's user avatar
  • 15.3k
7 votes
Accepted

Is it safe to reuse the password when using AES-CTR with scrypt?

CTR is insecure if you reuse a key/iv pair. Since the salt is random, a different encryption key will be derived every time you encrypt something. Therefore it is safe even if it always uses the zero ...
Conrado's user avatar
  • 6,484
6 votes

If and why is it bad to scrypt a bcrypted password?

The combined strength of two key stretching algorithms is not greater than the sum of its parts. It is at best equal to the sum of its parts. If you budget $x$ amount of CPU time to password ...
Future Security's user avatar
6 votes

I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error

The question correctly finds that In the case of PBKDF2, you will need to buy an ASIC to be ideal and proceeds assuming the legitimate server does that; or at least, uses a GPU as substitute. ...
fgrieu's user avatar
  • 142k
5 votes

Do I need to sanitize user input to scrypt, or to PBKDF's in general?

This will depend on the specific implementation of the KDF that you're using. I'm not aware of any known issues with scrypt (although that doesn't meant there aren't any), but there have certainly ...
Gh0stFish's user avatar
  • 151
4 votes

Is it Ok in practice to rely only on the first 64 bits of a scrypt hash in this scenario?

No, you cannot assume that no collisions can be found if there is a chance of $1 \over 2^{32}$ per try. That's too high a risk for almost any kind of cryptographic scheme, especially if parallel ...
Maarten Bodewes's user avatar
  • 93.2k
4 votes

HKDF: ikm, salt and info values

The salt is not required to make HKDF secure. Using a static salt doesn't make too much sense - you should be perfectly fine with using an empty salt. Either you can use an empty salt, or a new random ...
Maarten Bodewes's user avatar
  • 93.2k
4 votes
Accepted

Hashing high entropy key into AES format

I seem to recall that shared secret keys should be hashed before using as encryption keys (some brief discussion here). If your key is already high-entropy, then hashing with SHA256 is fine. If you ...
hunter's user avatar
  • 3,975
4 votes

What does "sequential memory-hard" mean?

The Scrypt paper here defines memory-hard and sequential memory hard, and accordingly explains why one was used over the other. Definition 1. A memory-hard algorithm on a Random Access Machine is an ...
Modal Nest's user avatar
  • 1,453
3 votes
Accepted

Encryption program conseil

I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). You should use authenticated encryption unless you have a strong reason not to. For example, AES-GCM, or AES-CTR ...
Squeamish Ossifrage's user avatar
3 votes
Accepted

Scrypt sanity check

Your code has computed the correct answer. There are some known-answer tests in the scrypt Git repository. They're going to be a little more reliable than GCHQ's toy web interface which is ...
Squeamish Ossifrage's user avatar
3 votes

Is it Ok in practice to rely only on the first 64 bits of a scrypt hash in this scenario?

15,000,000,000 passwords For a 64-bit hash, the probability that a collision exists is approximately $1 - e^{-(15,000,000,000)^2 / (2^{64} \times 2)} \approx 0.9978$. So whatever the hash algorithm ...
Gilles 'SO- stop being evil''s user avatar
3 votes

What is a SHA1_Compress() function?

The function SHA-1 is defined on a message $m$ that is a sequence of bits. It works as follows—this form is named Merkle–Damgård after the people who suggested it in days of yore: Let $m' = m \...
Squeamish Ossifrage's user avatar
3 votes
Accepted

How to make my hash more robust to the brute force?

I would recommend you use Argon2, which is both a slow KDF like PBKDF2, as well as a memory-hard function designed to improve resistance to GPUs and FPGAs like scrypt. You can select both the number ...
forest's user avatar
  • 15.3k
3 votes

I think PBKDF2 may be better than Scrypt? Looking for someone to point out my logical error

Nobody wants to buy special hardware for hashing passwords. What we want is to use whatever resources I have anyway cheap give a modest compute budget to your hashing and still hope a well funded ...
Meir Maor's user avatar
  • 11.8k
3 votes
Accepted

What do the last chunks of the output string of Scrypt contain?

I should have started here: ...
lepe's user avatar
  • 171
3 votes
Accepted

Is it safe to reuse the same nonce for decryption an indefinite amount of times in this context?

Specifically, is it safe to re-use the same nonce for decryption an indefinite amount of times, if you only use it once for encryption? Indeed, all good security definitions (under which ciphers are ...
SEJPM's user avatar
  • 46.1k
3 votes
Accepted

How to estimate the maximum computational cost bound for Key Derivation Functions (KDFs) before it becomes useless security-wise?

Generally we look at strength by looking at the order $O$ that it adds to the password search when an attacker is trying to guess passwords. That's just the same as the number of iterations basically, ...
Maarten Bodewes's user avatar
  • 93.2k
3 votes
Accepted

Is SHA1 break significant for an algorithm intended to be Proof-Of-Work?

Proof-Of-Work requires pre-image resistance of the hash function, not the collision resistance. Due to the BitCoin, many people wanted to revert ( revert is the slang term in terms of Cryptography, ...
kelalaka's user avatar
  • 49k
3 votes
Accepted

Salt value in scrypt algorithm

The purpose of salt is to prevent usage of rainbow tables. Simply put, use different salts for hashing of different passwords. Salt does not need to be secret. It is a common practice that salt is ...
mentallurg's user avatar
  • 2,621
2 votes

Appropriate scrypt parameters when generating an scrypt hash

Which parameters are suitable for your system depends on what execution time you accept. Higher values increase the security - but also the execution time. The default parameters for scrypt are N=...
BeloumiX's user avatar
  • 995
2 votes
Accepted

Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?

The signature for scrypt, straight from the source: ...
Luis Casillas's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible