Tag Info

New answers tagged

17

FIPS 140-2 does not cover the topic of password hashing. Thus, there is no password hashing function which would be "FIPS-approved" in that sense. Using SHA-512 "as is", with or without some salt and regardless of how you inject the said salt in the engine, would not grant you the NIST approval. NIST simply does not approve (or disapprove of) password ...


5

FIPS 140-2 does not list password hashing algorithms. If you actually need to use FIPS 140-2 validated algorithm, you need to find solutions that were validated by NIST for your required compliance level. You probably need to verify this with a FIPS auditor, but PBKDF2 has implementations like PBKDF2-HMAC-SHA256 or 512 for instance. That could be regarded ...


1

The general response to this is correct - if your server is storing a copy of a key that's used to encrypt something in memory, there is a chance that an exploit will allow it to be stolen. (See: heartbleed) I think it's definitely worth asking in this case why you need to store a hash and an encrypted version of the password. I can see a system in which ...


0

It is about how you interpret what they are writing. They are not saying you should not hash and should store passwords in plain text. What it is saying is that the value you write into LDAP is not hashed or encrypted. This is like the situation you have with a normal database. You can define a column called password and you can either tell the database to ...


0

If you are looking for details, RFC 4880 describes all the details for implementing OpenPGP, which as far as I can tell is the most common method of encrypting data with one key (KEY1), encrypting that key with a second key (KEY2) to generate an encrypted key ("Enc_KEY1"), storing both the encrypted data and the encrypted key. Later only people who have (or ...


1

The string length of a bcrypt hash isn't compatible as an AES key because of length and illegal characters such as periods and dollar signs. How does one deal with this problem? Base64 encoding is your friend. Base64 encoded character are all legal characters with AES When it comes to decrypting Enc_KEY1, I have to first generate KEY2 from a hash ...



Top 50 recent answers are included