Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 12407

PBKDF2 is a key derivation and strengthening function, commonly used for password storage.

12
votes
Not all KDFs are slow! Something like HKDF is extremely fast, and only involves a handful of invocations to the underlying PRF. KDFs are only slow when they're intended to convert a potentially low-e …
answered Oct 4 by Stephen Touset
2
votes
Simply hashing the BCrypt digest with SHA-256 will trivially expose encryption keys if your password database is compromised. Using the PBKDF2 of the password itself for encryption keys prevents this … . Of course, there are drawbacks. With the described scheme, the server can perform cryptographic operations with the user's key at any time, which may be desirable or necessary. When the PBKDF2 of …
answered Jan 23 '13 by Stephen Touset
6
votes
From Colin Percival's paper on scrypt: By using a key derivation function which requires 2^s cryptographic operations to compute, the cost of performing a brute-force attack against passwords with …
answered Oct 24 '13 by Stephen Touset
4
votes
The IV must be unique for each invocation of CBC. The salt to generate your key through PBKDF2 will be constant, otherwise you would be generating different keys. So, no. …
answered Feb 25 '13 by Stephen Touset
6
votes
"peppers", and I am unaware of any cryptographic literature which supports or encourages their use. Third, PBKDF2 is okay, but seriously just use BCrypt. BCrypt was designed for this and is in … widespread use. Good BCrypt implementations will handle salt generation and work factor calibration / autodetection for you. You will have to implement these things yourself to use PBKDF2, and you will almost …
answered Oct 23 '12 by Stephen Touset