Timeline for Does using a random number of iterations for PKBDF2-SHA256 help if I only have to protect one key used to encrypt a password protecteded file?
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 6, 2021 at 13:28 | comment | added | Antonio | @Anders I tried to modify accordingly my question | |
| Aug 4, 2021 at 16:55 | comment | added | Anders | @Antonio Mentioning that in your question would be a good idea. For someone to be able to answer the last question in your post, more information is needed. Does the attacker have the file? Is the number of iterations in the file? How was the file generated? | |
| Aug 3, 2021 at 16:52 | comment | added | Antonio | @Anders I am protecting a file with a password, so I think the answer to your question is "stretching encryption keys". Should my question be rephrased? | |
| Aug 3, 2021 at 14:01 | comment | added | Anders | @nobody If the use case is password hashing for user authentication, it is good practice to treat the full string as a single unit, and let a well tested hash library take care of the details. But maybe that is not the use case here. | |
| Aug 3, 2021 at 13:59 | comment | added | Anders | @Antonio Are you using PBKDF for hashing passwords for user authentication, or for stretching encryption keys? I assumed the former, perhaps incorrectly. Sorry if my tag edits made your question make less sense. | |
| Aug 3, 2021 at 12:20 | comment | added | nobody | I didn't check, but I don't think outputting the number of rounds is part of the standard. I don't see any reason why you couldn't just strip out that part and just store the hash, assuming that you store the number of rounds somewhere else (like hardcode it). | |
| Aug 3, 2021 at 12:16 | comment | added | Antonio | In the specific library I am using to encrypt, the number of iterations doesn't seem to be visible in the encrypted file. Maybe I didn't understand correctly what you mean: are you saying that there is a program that can see from an encrypted file how many iterations where performed to protect the key? I do understand and agree that having a longer/stronger/higher entropy password is a certain way to improve security, I wonder if an obfuscated the number of iterations can make the work of the attacker even more difficult. | |
| Aug 3, 2021 at 10:04 | history | edited | Anders | CC BY-SA 4.0 |
added 135 characters in body
|
| Aug 3, 2021 at 9:53 | history | answered | Anders | CC BY-SA 4.0 |