0
votes
1answer
59 views

Password Storage with Jasypt StrongPasswordEncryptor vs PBKDF2

We are currently working on authentication for a web application. For password storage, we're using Jasypt StrongPasswordEncryptor with SHA-256 and tens of thousands of iterations. Going into the ...
1
vote
0answers
64 views

Login details security using salt n hash and a login role in postgresql

I am coding up the security for a website in express.js and postgresql db. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but my ...
5
votes
4answers
613 views

Secure authentication: partial client-side key stretching… please review/criticize my idea

I am trying to figure out what would be the 'perfect' authentication system for a website. On one end, we know that simple hashing algorithms can be brute-forced or cracked in other ways. Hence why ...
3
votes
2answers
552 views

Store private key on server, then use k1 to log in, k2 to verify HMAC and k3 to decrypt private key

I'm working on a proof-of-concept program to encrypt email with less difficulty for end-users with a process like: To create an account: Generate a random salt and IV, and get a password from the ...
2
votes
2answers
750 views

Login system using authenticated encryption without storing user password

I'm not a security expert, so I might be asking a silly question, but let me describe what I am thinking about. First, I know that a lot of web sites store hashed/encrypted passwords which could be ...
2
votes
1answer
471 views

Improving Digest Authentication using PBKDF2

For a variety of reasons, I need to use digest authentication for a REST server that I have created. I have come up with an "improvement" that I believe strengthens the algorithm against MD5 attacks ...
8
votes
3answers
966 views

Verify Login and Encrypt with PBKDF2

I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
6
votes
1answer
3k views

Does NIST really recommend PBKDF2 for password hashing?

We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for ...