Collaborate Disseminate
What are the considerations when picking the best password hashing algorithm in .NET Core?
I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting various implementations from Nu… Continue reading Which is the best password hashing algorithm in .NET Core?
i’m building an app that really needs encryption of this type , my question is it safe to store the aes encrypted RSA key in the database ?
here is how i encrypt the key :
i generate a random 256 bit number and turn it to … Continue reading is it safe to AES encrypt the RSA private key and storing it in the database
The example I’m working on is this:
i store the user password using Argon2 in my database
and then use PBKDF2 to derive an AES key from the user password , and store only the salt used in PBKDF2, i use the output from this … Continue reading Is it safe to use 2 password derivation functions to one password?
Argon2 is the winner of the Password Hashing competition, and currently recommended by OWASP for secure storage of passwords.
One crucial step of Argon2 is determining the parameters used by the function. The current IETF draft titled &quo… Continue reading What are the minimum parameters for Argon2?
I want code very secure system and I need some answers and help.
Is this secure if encrypting file and it is possible decrypt with barcode/QRCode where is decryption key to view it.
I’ve thinking of use libsodium and ARGON2… Continue reading encrypting file and user have public key to decrypt in barcode
I’ve read quite a bit of the StackExchange and HackerNews debates on the user of “peppers” in password hash security. There are a number of different implementations of the idea of a pepper, ranging from an additional hardcod… Continue reading Appending a secret (pepper) to Argon2 password hashes
Let’s assume I would like to secure passwords using a modern KDF such as Argon2. The flow of information would look like this: $hash,$salt = argon2id($password, $salt).
Is there any advantage to first hash the password using… Continue reading Is there any advantage to combining a hash algorithm with a key-derivation function?
There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, but most of them date quite a bit.
The… Continue reading In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?
In using Argon2 for hashing passwords in my application, I’ve noticed it generates a string like this (e.g. for password “rabbit”):
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$fPn4sPgkFAuBJo3M3UzcGss3dJysxLJdPdvoj… Continue reading Is it safe/wise to store a salt in the same field as the hashed password?
I’m trying to follow the OWASP Password Storage Cheat Sheet recommendations on keyed functions, which recommend:
return [salt] + HMAC-SHA-256([key], [salt] + [credential]);
Using libsodium-net, the simplest method uses an … Continue reading Applying keyed function on password – practical considerations