Key-stretching adds additional security to potentially weak keys by requiring an expensive computation to transform the initial key into a derived key.

learn more… | top users | synonyms

0
votes
0answers
43 views

Strange Security Key of F.C.E. 365 - What this protect? [on hold]

Is someone able to tell me what crypto algorithm F.C.E 365 is using? I caught the following key from a faulty old version of F.C.E. 365 Carmen. I can't understand a bit of it. What is this key meant ...
0
votes
1answer
31 views

Should I stretch the secret key in a secure cookie protocol implementation?

I'm building an api authentication layer that basically works like the secure cookie protocol, where instead of a cookie I give the api client a token which they must provide on subsequent requests. ...
4
votes
2answers
97 views

Do GPG and OpenSSH use key stretching on their keypairs?

Both OpenSSH and GPG can generate key pairs which are stored as files in well-known paths inside the user directory. A passphrase is always asked for during the generation process, which is then used ...
2
votes
2answers
305 views

Is upgrading key-stretching algorithms and/or repetitions a thing?

Consider back in the 90s you're ahead of the curve, you hashed and salted your passwords with SHA, and you're a big site, millions of accounts, etc. Well the web evolves, and over time more advanced ...
0
votes
2answers
147 views

Password stretching using concatenation of hashes

I'm working on a simple file encryption tool. Basically, here's how my program works: password = get_user_typed_password() salt = uuid4() key = bcrypt(password + salt) cipher = AES(key) for block ...
0
votes
1answer
100 views

Seeking help with implementing SCRAM in .NET

I'm late to the party and need to be caught up. I'm doing my homework looking things up. I know that I don't want unsalted challenge-response CRAM, I want salted challenge-response SCRAM. I think ...
12
votes
3answers
527 views

Can I use the same password both for SRP and for client-side encryption?

Suppose a less-than-trusted server is used to store users' confidential data (encrypted at the client side), and both tasks - authentication and encryption/decryption - should be doable with a single ...
0
votes
1answer
263 views

Should I run my password through Bcrypt before using it for encrypting a file with AES-256? [duplicate]

I need to encrypt a file with a password that can be memorized. So I was thinking about running the password through some rounds of Bcrypt before using it for AES encryption, so every time I want to ...
1
vote
2answers
161 views

Should hashing hashed hashes colide or not?

Since key stretching basically boils down to hashing hashes over and over again (where salt, pepper and password individualize the hash function, but the principle remains the same), I wonder about ...
3
votes
1answer
3k views

BCrypt+SHA256 vs PBKDF2-SHA256

From this question, the OP posited taking a user's entered password, running it through BCrypt, then running that through SHA256 to produce a 256-bit password-derived key. (EDIT: To clarify, these two ...