PBKDF2 is a key derivation and strengthening function, commonly used for password storage.

learn more… | top users | synonyms

1
vote
1answer
239 views

Tracking IP address to prevent abuse without logging user metadata

I am trying to balance good security practices against excessive logging of user metadata / Personally Identifiable Information. I am constructing a web app that tracks IP addresses to prevent abuse, ...
1
vote
2answers
393 views

PBKDF2: can the salt be known from the hash?

I understand that some KDFs bundle the salt with the output, such as bcrypt (modular crypt format). In PKCS5_PBKDF2_HMAC (specifically, looking at OpenSSL implementation) with a single iteration, is ...
0
votes
3answers
113 views

Password history with PBKDF2

Scenario: Cannot use previous 15 passwords Using PBKDF2 with iterations targeting 1 second execution time In this scenario, when a user wishes to create a new password, the server must combine ...
2
votes
0answers
17 views

How exactly is the output of the XOR step in PBKDF2 used? [migrated]

I'm attempting to diagram PBKDF2 for a school project and I'm not 100% sure how to represent the XOR step. Specifically, I'm confused as to whether the output of the XOR step is used in subsequent ...
12
votes
6answers
3k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
2
votes
3answers
108 views

PBKDF2 used to generate an encryption key: long shared secret (password) vs iterations count

I want to use pbkdf2 to generate a key for a symetric encryption (DES, 3DES, may be AES) algorith, that will be used to secure private data between an AS/400 and another computer (probably running ...
1
vote
1answer
119 views

What is the right way to implement Keyed Password Hashing?

As mentioned in this wonderful link, the way to get a PBKDF2 Hash of a user given password given a password (of course), a salt (generated Cryptographically Secure Random Number Generator. iteration ...
2
votes
2answers
31 views

Simple PBKDF2 vs. scrypt question

scrypt was designed to use more memory. We can use its parameters to specify (approximately) how much memory we want it to require. But both scrypt and PBKDF2 allow us to specify the output data ...
1
vote
1answer
178 views

How to safely use a Key Derivation Function to secure private data - need guidance

I have some secure data created in my client app which I wish to store on the server as backup for the user. The user already has a password to authenticate with the server. The password is never ...
3
votes
1answer
84 views

Encryption and HMAC with the same password

I need to send authenticated ciphered messages by using a single password. Reusing the same (derived) key for the block cipher and the HMAC is not a good practice, I know. My initial idea is to ...
1
vote
0answers
88 views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
63
votes
4answers
13k views

Recommended # of iterations when using PKBDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
7
votes
4answers
1k views

Gold Standard for password hashing

I've developing a web application that will be dealing with highly sensitive information and I want to ensure the hashing of passwords is gold standard. Ideally I'd go for per-user salted SHA512 ...
0
votes
2answers
43 views

Protect against malicious client with key derivation function (PBKDF2)?

Consider a protocol that allows clients to retrieve XML "forms" from a server. Forms are identified by a unique, randomly generated form ID that is embedded in the form. Clients fill out the form and ...
0
votes
1answer
195 views

Password Storage with Jasypt StrongPasswordEncryptor vs PBKDF2

We are currently working on authentication for a web application. For password storage, we're using Jasypt StrongPasswordEncryptor with SHA-256 and tens of thousands of iterations. Going into the ...
0
votes
1answer
100 views

Will obtaining password hash compromise derived encryption key?

I've been looking at how PBKDF is used to generate encryption key for AES. One thing I couldn't get my head around is that how those OS keep the encryption key safe apart from using hardware modules. ...
1
vote
2answers
135 views

How to know which output length to request from PBKDF2?

I feel like I'm asking a fairly obvious question here, but with it being so easy to make mistakes in this space, here goes. From wikipedia: DK = PBKDF2(PRF, Password, Salt, c, dkLen) dkLen ...
3
votes
2answers
218 views

Why use PBKDF2 over multiple iterations of a another cryptographic hash function?

People often recommend PBKDF2 over using hash functions directly, but typically they compare PBKDF2 to a single unsalted hash. What advatages are there to using PBKDF2 over multiple iterations of a ...
0
votes
1answer
67 views

two encrypting / hashing case, which one is best

Thinking about these below two cases, which one is best and most secure one 1st case //key1 generated from static salt and user password, because in case attacker don't know about source code (bad ...
0
votes
2answers
157 views

Any reason to use bcrypt, pbkdf2, scrpt for other things than passwords? [closed]

Let's say I want to hash some data, using SHA256, in order to prove I know something. Maybe it's my secret ID for something. In the real of passwords we have moved from hashing -> hashing+salt -> cpu ...
1
vote
0answers
82 views

Login details security using salt n hash and a login role in postgresql

I am coding up the security for a website in express.js and postgresql db. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but my ...
2
votes
3answers
118 views

Limit attempt of user login against PBKDF2

I have been tasked been tasked by my boss to change the encryption system of our web application from MD5 to PBKDF2 as MD5/SHA1 has been shown to be breakable in recent years . I argued against it ...
2
votes
1answer
222 views

Supplying a password to PBKDF2 in raw binary vs. base64?

Background: I'm working with Node's crypto library. I'm using PBKDF2 to convert a variable-length binary "passphrase" into constant-length keys for an AES cipher later on. The underlying source of ...
5
votes
2answers
153 views

Benefit to using PBKDF2 on key generated by RNGCryptoServiceProvider?

I have a program that generates a fixed-length 32 byte (256-bit) password using RNGCryptoService provider and then uses Rfc2898DeriveBytes on that password to arrive at an encryption key. However, to ...
4
votes
2answers
1k views

Is it safe to use PBKDF2 for hashing?

I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
1
vote
2answers
253 views

Do I need to salt PBKDF2 when it's used for AES encryption

If I'm using PBKDF2 to stretch a password into a suitable key for use in encryption with AES, should I be using a random salt (for PBKDF2, not the AES IV)?
3
votes
2answers
679 views

Using AES to encrypt user data

I know next to nothing about cryptography, and I'm basically just looking for someone to look over what I'm doing and tell me if I'm screwing up. I have the user entering in some sensitive ...
8
votes
4answers
793 views

At what point does adding more iterations to PBKDF2 provide no extra security?

If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an ...
6
votes
4answers
686 views

Secure authentication: partial client-side key stretching… please review/criticize my idea

I am trying to figure out what would be the 'perfect' authentication system for a website. On one end, we know that simple hashing algorithms can be brute-forced or cracked in other ways. Hence why ...
4
votes
2answers
1k views

How much does unknown PBKDF2 iteration count improve security?

We are crackers who get our hand on an encrypted file. We know the whole file is AES-256 encryption of the original plaintext file. We also know that PBKDF2 was run 1000 times on the original plain ...
1
vote
1answer
329 views

Questions towards my application that uses bouncy castle crypto

I am implementing an application using bouncy castle crypto API it uses AES-CBC to encrypt files and i have some questions regarding the development of my application. I dont want to use a static ...
3
votes
2answers
598 views

Store private key on server, then use k1 to log in, k2 to verify HMAC and k3 to decrypt private key

I'm working on a proof-of-concept program to encrypt email with less difficulty for end-users with a process like: To create an account: Generate a random salt and IV, and get a password from the ...
2
votes
2answers
872 views

Login system using authenticated encryption without storing user password

I'm not a security expert, so I might be asking a silly question, but let me describe what I am thinking about. First, I know that a lot of web sites store hashed/encrypted passwords which could be ...
2
votes
3answers
138 views

User specified iteration count

I'm working on a PHP authentication and registration system following the standard salt+password = 'auth hash' and using the plaintext/unencrypted username as the lookup field on the initial query. ...
4
votes
1answer
288 views

RSA vs PBKDF2 for password storage (theoretical)

I know this is not the right way to store passwords, but I'm asking this from a theoretical perspective: Suppose a web site's passwords were encrypted with RSA asymmetric encryption and the private ...
5
votes
2answers
438 views

Why is 8ms a goal for hashing?

I'm currently developing a small project in PHP, and as it involves user authentication, I've been researching what options I've got regarding hashing. I've settled on PBKDF2 primarily due to it's ...
8
votes
3answers
1k views

Verify Login and Encrypt with PBKDF2

I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
7
votes
3answers
360 views

Increase the security of an already stored password hash

Right now we're using 1024 byte PBKDF2 with 256 byte user-specific salt and variable iterations. However, I would much prefer to be able to, perhaps once every year or two, to be able to flat out ...
21
votes
5answers
2k views

Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?

I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line. I want to increase the cost every year of my users passwords. One solution is to recalculate them ...
3
votes
2answers
1k views

LastPass One Time Recovery Passwords--How?

The LastPass password manager stores One Time Recovery Passwords locally in each browser you use the plugin with: http://helpdesk.lastpass.com/account-recovery/ My question is, how can you have more ...
2
votes
1answer
566 views

Improving Digest Authentication using PBKDF2

For a variety of reasons, I need to use digest authentication for a REST server that I have created. I have come up with an "improvement" that I believe strengthens the algorithm against MD5 attacks ...
4
votes
3answers
422 views

Client-Side Hashing to decrease value of password guessing heuristics

Yes, this is 'yet another client-side hashing' question. But, don't leave yet, I think there is some value here. I'd like to do something to mitigate the affect on the community as a whole when my ...
6
votes
2answers
437 views

How less secure is an encryption if we know something about the original data?

I have a number of files encrypted with a key derived from a password. In line with standard practice, I use a random salt and password and do many PBKDF2 iterations to obtain an encryption key and ...
3
votes
1answer
1k views

Key length and hash function in PBKDF2

On this page: http://www.ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL/PKCS5.html they make a statement that strikes me as rather weird: Key Length Specifies the length in bytes of ...
3
votes
4answers
566 views

Is it safe to have the salt equal to IV?

If I'm using AES-256 CBC to encrypt, getting the 32 byte key using multiple iterations of the PBKDF2 function with a 16 byte salt, is it safe for me to let IV be equal to the salt? (Edit: The salt is ...
4
votes
3answers
2k views

Can the salt for PBKDF2 be a hash of the user-entered password?

I want to derive a key from a password in a client application that will be used as a master key that decrypts a data key. As far as I understand the salt should be private knowledge. Would it be ...
3
votes
1answer
2k views

BCrypt+SHA256 vs PBKDF2-SHA256

From this question, the OP posited taking a user's entered password, running it through BCrypt, then running that through SHA256 to produce a 256-bit password-derived key. (EDIT: To clarify, these two ...
0
votes
3answers
169 views

Maintain sensitive key between requests

EDIT: Reworked question. Previous version too poorly asked. On my website users write sensitive messages that must be kept secret. The entire user area is over SSL, so the communication between user ...
7
votes
3answers
683 views

How should I choose a difficulty factor for my password hashing function?

Assuming that I'm doing password hashing properly and using bcrypt, scrypt or PBKDF2, how should I go about choosing an appropriate difficulty factor? i.e rounds for bcrypt, iterations for PBKDF2 and ...
12
votes
2answers
4k views

With PBKDF2, what is an optimal Hash size in bytes? What about the size of the salt?

When creating a hash with PBKDF2, it allows the developer to choose the size of the hash. Is longer always better? Also, what about the size of the random salt? Should that be the same size as the ...