I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an ...
I'm working on a PHP authentication and registration system following the standard salt+password = 'auth hash' and using the plaintext/unencrypted username as the lookup field on the initial query. ...
EDIT: Reworked question. Previous version too poorly asked. On my website users write sensitive messages that must be kept secret. The entire user area is over SSL, so the communication between user ...
I can't find a way of specifying the hashing algorithm used by the PBKDF2 (the Rfc2898DeriveBytes class) implementation in C# System.Security.Cryptography. It seems to be just SHA1. Am I missing ...
I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...