We are currently working on authentication for a web application. For password storage, we're using Jasypt StrongPasswordEncryptor with SHA-256 and tens of thousands of iterations. Going into the ...
I am coding up the security for a website in express.js and postgresql db. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but my ...
I am trying to figure out what would be the 'perfect' authentication system for a website. On one end, we know that simple hashing algorithms can be brute-forced or cracked in other ways. Hence why ...
I'm working on a proof-of-concept program to encrypt email with less difficulty for end-users with a process like: To create an account: Generate a random salt and IV, and get a password from the ...
I'm not a security expert, so I might be asking a silly question, but let me describe what I am thinking about. First, I know that a lot of web sites store hashed/encrypted passwords which could be ...
For a variety of reasons, I need to use digest authentication for a REST server that I have created. I have come up with an "improvement" that I believe strengthens the algorithm against MD5 attacks ...
I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for ...