Questions tagged [key-stretching]

Key-stretching adds additional security to potentially weak keys by requiring an expensive computation to transform the initial key into a derived key.

Filter by
Sorted by
Tagged with
14 votes
2 answers
4k views

Is KeePass's method for key derivation secure?

I'm familiar with how key derivation functions can be used to slow down brute force attacks against passwords by requiring significant computational and/or memory resources to compute the final key. ...
Ajedi32's user avatar
  • 4,753
13 votes
3 answers
905 views

Can I use the same password both for SRP and for client-side encryption?

Suppose a less-than-trusted server is used to store users' confidential data (encrypted at the client side), and both tasks - authentication and encryption/decryption - should be doable with a single ...
mgibsonbr's user avatar
  • 2,925
10 votes
1 answer
4k views

Does 7-Zip really run multiple rounds of SHA-256 when key stretching?

Recently I was testing whether I could make 7-Zip archives more bruteforce-resistant. Both someone on Wikipedia and @kelalaka on this website make the following claim: The 7z format supports ...
d33tah's user avatar
  • 6,544
7 votes
2 answers
794 views

Do GPG and OpenSSH use key stretching on their keypairs?

Both OpenSSH and GPG can generate key pairs which are stored as files in well-known paths inside the user directory. A passphrase is always asked for during the generation process, which is then used ...
Marcel Hernandez's user avatar
5 votes
1 answer
358 views

Is it possible to use parallelism when computing a key derivation function for a single password/key?

Suppose I have an AES-256 encrypted file, and I want to derive the key using PBKDF2 and a given salt with a large number of rounds (say 1 million), but I'm limited by user tolerance for UI lag when ...
samgak's user avatar
  • 2,068
4 votes
1 answer
313 views

Why isn't it more popular to increase the p (parallelization) parameter of scrypt?

First of all, the understanding I have of the p parameter in scrypt is that it multiplies the amount of work to do, but in such a way that the additional workloads are independent from each other, and ...
negamartin's user avatar
4 votes
2 answers
5k views

BCrypt+SHA256 vs PBKDF2-SHA256

From this question, the OP posited taking a user's entered password, running it through BCrypt, then running that through SHA256 to produce a 256-bit password-derived key. (EDIT: To clarify, these two ...
KeithS's user avatar
  • 6,768
3 votes
1 answer
612 views

Length of a stretched gnupg passphrase that is comparable in strength to an unstretched string of 256 random bits

Assume that we want to encrypt a file with gnupg using AES-256 as the encryption algorithm. (Hence, symmetric encryption.) In this mode, gnupg requires a passphrase from the user. I understand that ...
kjo's user avatar
  • 1,063
3 votes
2 answers
582 views

Naive key stretching vs PBKDF2

What are the drawbacks of using a trivially simple key stretching approach such as the below Python example, compared to something like PBKDF2? The purpose is to harden an AES-encrypted file against ...
John Blatz's user avatar
  • 1,011
3 votes
1 answer
258 views

Key stretching approaches

I've seen that a number of key stretching algorithms and they involved increasing the number of operations needed to compute the key(i.e. the number of rounds within a hash function). But, I wonder if ...
Sebi's user avatar
  • 1,391
2 votes
2 answers
437 views

Is upgrading key-stretching algorithms and/or repetitions a thing?

Consider back in the 90s you're ahead of the curve, you hashed and salted your passwords with SHA, and you're a big site, millions of accounts, etc. Well the web evolves, and over time more advanced ...
Andrew Hoffman's user avatar
1 vote
1 answer
292 views

AES-256 without key stretching

It is not so difficult to create a password which is exactly 32 characters long. In this question - AES-256 Key Length Importance @Marc writes: you absolutely should not be using a password as the ...
cardamom's user avatar
  • 379
1 vote
2 answers
335 views

Should hashing hashed hashes colide or not?

Since key stretching basically boils down to hashing hashes over and over again (where salt, pepper and password individualize the hash function, but the principle remains the same), I wonder about ...
Tobias Kienzler's user avatar
0 votes
2 answers
591 views

How secure is the hashing/salting/stretching process as described in this diagram?

Question I was just brainstorming about the hashing, stretching, salting part of the user password in the authentication process and I want it to be as secure as possible (no matter how paranoid that ...
Bob Ortiz's user avatar
  • 6,665
0 votes
2 answers
381 views

Password stretching using concatenation of hashes

I'm working on a simple file encryption tool. Basically, here's how my program works: password = get_user_typed_password() salt = uuid4() key = bcrypt(password + salt) cipher = AES(key) for block ...
SuperPython's user avatar
0 votes
1 answer
166 views

Does stretching a hash increase a denial-of-service (DoS) risk and does brute-force protection mitigates that?

Disclaimer: I noticed several questions on this site but none really answer this two questions directly. Therefor I do not consider this duplicate. Personally I really like the article called Some ...
Bob Ortiz's user avatar
  • 6,665
0 votes
1 answer
201 views

Should I stretch the secret key in a secure cookie protocol implementation?

I'm building an api authentication layer that basically works like the secure cookie protocol, where instead of a cookie I give the api client a token which they must provide on subsequent requests. ...
AndrewSwerlick's user avatar
0 votes
1 answer
350 views

Seeking help with implementing SCRAM in .NET

I'm late to the party and need to be caught up. I'm doing my homework looking things up. I know that I don't want unsalted challenge-response CRAM, I want salted challenge-response SCRAM. I think ...
Andrew Hoffman's user avatar
0 votes
1 answer
670 views

Should I run my password through Bcrypt before using it for encrypting a file with AES-256? [duplicate]

I need to encrypt a file with a password that can be memorized. So I was thinking about running the password through some rounds of Bcrypt before using it for AES encryption, so every time I want to ...
ChocoDeveloper's user avatar
-1 votes
1 answer
250 views

An idea for password checking?

I will try and make this idea as detailed as possible, to help the community in assisting and possibility helping others with the same problem. Background Info My system has 60 users. Each user has ...
ian smith's user avatar
-1 votes
3 answers
1k views

256-bit Symmetric Keys As Passwords

Would using a 256-bit binary string, for e.g. ...
Woodstock's user avatar
  • 689