Questions tagged [pbkdf2]

PBKDF2 is a key derivation and strengthening function, commonly used for password storage.

13 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
3k views

Using PBKDF2 for hash and AES key generation implementation

I am writing a Java application that is required to locally authenticate a user with a password and then use the password to generate an AES-256 key for local file encryption/decryption. I understand ...
1
vote
0answers
73 views

Re-using the hash value of password to server by malicious actor

Let's say Alice logged into https://www.facebook.com with her email and password: Email: Alice@gmail.com Password: correctHorseShoeBattery Nonce given by ...
1
vote
0answers
567 views

SQLCipher and PRAGMA key on iOS

I'm a bit confused as to how SQLCipher handles the PRAGMA key provided for encrypting the SQLite database For background: I'm looking at options for encrypting application data at rest. From the ...
1
vote
0answers
1k views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
0
votes
1answer
91 views

How can I calculate the entropy reduction in my system I'm going to introduce?

I am the creator of LessPass, a deterministic password generator. The core of LessPass is not very complicated. I have 2 methods calc_entropy and render_password: calc_entropy transforms the master ...
0
votes
0answers
91 views

Safest alternative for hashing credit card numbers to use the hash as fingerprint?

Same question asked here in 2014 but since a lot has changed since then, I would like to get feedback from experts on the latest best practices. The problem We need to hash credit card numbers to ...
0
votes
0answers
90 views

Securely encrypt and decrypt files via PBE in Java (Jasypt seems insecure)

This post has been MOVED to StackOverflow due to lack of answers on Info Security: https://stackoverflow.com/questions/60960802/securely-encrypt-and-decrypt-files-via-pbe-in-java-jasypt-seems-...
0
votes
0answers
34 views

Establish a symmetric key: KDF based on shared secret and random salt or key wrapping?

I am designing a basic KMS based on a simple HSM, I only have access to: AES256, SHA256, PBKDF2, HMAC (and combinations like AES256-HMAC-SHA256). The admin and the users of the system have a personal ...
0
votes
2answers
180 views

PBKDF2 hash over PBKDF2 key derivation

Imagine an app where any user provides a username and a password. This password is used to generate a 'strong' encryption key (for AES encryption) with the PBDKF2 key derivation algorithm. This ...
0
votes
0answers
61 views

Password authentication using a master key and KDF without storing password

I want to make a service stateless(has no data to store or mantain). But the service shoule be able to authenticate user. What I'm considering is using key derivation function with a shared master ...
0
votes
0answers
143 views

Why does linux cryptsetup use PBKDF2 instead of bcrypt?

I've noticed that linux's cryptsetup utility by default uses the PBKDF2 for a key derivative function (KDF) versus using bcrypt, when bcrypt has more resistance to brute forcing from gpus. Why would ...
0
votes
0answers
130 views

How to tune a KDF algorithm to protect a private key?

I need to protect a private key RSA-4096 with a key derived by a KDF algorithm. Instead of hiding any aspect of the algorithm I would like to tune it such that the key derivation is a proof of work ...
0
votes
0answers
32 views

ECIES-like scheme using PBKF2?

I would like to marry ECIES to a scheme based on PBKFD2. Effectively, I want the Key Encapsulation Mechanism to use Diffie-Hellman, but rather than encrypting the seed material with the recipient's ...