0
votes
0answers
50 views

Utilizing PBKDF2 With OpenSSL crypto library [migrated]

I want to utilize the PBKDF2 algorithm with SHA1 HMAC (based on this answer). How can I utilize this through the crypto library? I started by looking at man openssl, but the openssl passwd command ...
0
votes
1answer
63 views

two encrypting / hashing case, which one is best

Thinking about these below two cases, which one is best and most secure one 1st case //key1 generated from static salt and user password, because in case attacker don't know about source code (bad ...
1
vote
0answers
57 views

How to safely use a Key Derivation Function to secure private data - need guidance

I have some secure data created in my client app which I wish to store on the server as backup for the user. The user already has a password to authenticate with the server. The password is never ...
4
votes
2answers
207 views

Is it safe to use PBKDF2 for hashing?

I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
6
votes
4answers
413 views

At what point does adding more iterations to PBKDF2 provide no extra security?

If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an ...
2
votes
3answers
114 views

User specified iteration count

I'm working on a PHP authentication and registration system following the standard salt+password = 'auth hash' and using the plaintext/unencrypted username as the lookup field on the initial query. ...
0
votes
3answers
150 views

Maintain sensitive key between requests

EDIT: Reworked question. Previous version too poorly asked. On my website users write sensitive messages that must be kept secret. The entire user area is over SSL, so the communication between user ...
3
votes
1answer
2k views

Is PBKDF2 only SHA1 in C#?

I can't find a way of specifying the hashing algorithm used by the PBKDF2 (the Rfc2898DeriveBytes class) implementation in C# System.Security.Cryptography. It seems to be just SHA1. Am I missing ...
52
votes
4answers
10k views

Recommended # of iterations when using PKBDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...