Linked Questions

2
votes
4answers
5k views

Is using 100,000 iterations of sha256 good enough for password storage? [duplicate]

I am creating a web app, and I was wondering if it would be secure to use 100,000 iterations of sha256 for storing passwords? I know that there are algorithms such as scrypt and bcrypt, however, I was ...
105
votes
3answers
75k views

Recommended # of rounds for bcrypt

What is nowadays (July 2012) the recommended number of bcrypt rounds for hashing a password for an average website (storing only name, emailaddress and home address, but no creditcard or medical ...
9
votes
3answers
9k views

Hashing length for storing password

Does larger hash size improve the security? Is it overkill to use 512 bit hash? If I stored only 256 bits of the PBKDF2-SHA512 derived key, is it less, equal or more safe than 256 bits of PBKDF2-...
6
votes
1answer
876 views

Is this security/encryption scheme secure?

I'm rolling my own, personal threetags.com-style 'encrypted data in the cloud' webapp (I didn't like the UI, and lack of non-browser client). However, I have absolutely no experience with security ...
11
votes
3answers
2k views

How should I choose a difficulty factor for my password hashing function?

Assuming that I'm doing password hashing properly and using bcrypt, scrypt or PBKDF2, how should I go about choosing an appropriate difficulty factor? i.e rounds for bcrypt, iterations for PBKDF2 and ...
6
votes
4answers
8k views

Can I brute-force a password hash even if I don't know the hash-algorithm used?

Can I brute-force a password hash even if I don't know the underlying algorithm? For example if I get hold of a database with password hashes and the used hash algorithm is unknown, like a random ...
5
votes
2answers
988 views

Why is 8ms a goal for hashing?

I'm currently developing a small project in PHP, and as it involves user authentication, I've been researching what options I've got regarding hashing. I've settled on PBKDF2 primarily due to it's ...
2
votes
2answers
4k views

Does changing the default number of iterations in KeePass (or other encryption applications) increase security?

Inspired by this question about the difficulty of cracking a KeePass database, I'm wondering if changing the default number of iterations in an encryption application (e.g., KeePass) increases ...
4
votes
2answers
4k views

BCrypt+SHA256 vs PBKDF2-SHA256

From this question, the OP posited taking a user's entered password, running it through BCrypt, then running that through SHA256 to produce a 256-bit password-derived key. (EDIT: To clarify, these two ...
6
votes
1answer
1k views

Should password hashes be encrypted or HMACed?

Assume I am hashing user passwords with PBKDF2, bcrypt, scrypt, or some other secure key derivation function. Are there: tangible security benefits, precedents, and respected research for ...
4
votes
2answers
2k views

Safe to store encrypted data with (password protected) pfx file

I have created a self signed certificate using Powershell's New-SelfSignedCertificate, with the intention of encrypting and storing a username / password in public. Specifically using - New-...
6
votes
2answers
546 views

If the bitcoin network was cracking bcrypt, what cost factor would you use?

Since the best example of pooled resource to crack hashes is the bitcoin network, currently churning through 2.14 ExaHashes/s. I want to ask, if the resources of this network were pointed towards ...
8
votes
1answer
529 views

What are the recommended scrypt cost factors for 2016?

I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?
1
vote
0answers
2k views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
2
votes
1answer
584 views

Encrypting files securely using user supplied password

I'm currently trying to build a (sort of) secure, desktop based RTF text editor written for node-webkit using node.js. Based on some answers that I read here, such as How can I securely convert a &...

15 30 50 per page