Collaborate Disseminate
When implementing password hashing using PBKDF2 for authenticating access to a REST api,when we say that PBKDF2 is slow does it mean that it’s going to take a lot of time to hash the password and validate it, therefore the service not bein… Continue reading PBKDF2 usage will slow REST API down?
Is there a (relatively simple) protocol for setting up a (6-digit) PIN on a remote server, that also prevents those, who may get a DB dump from the server, from brute-forcing that PIN?
Is PBKDF2 and key transfer via TLS 1.2 good enough a s… Continue reading Securely establish and verify PIN over network
So the goal is to use AES-CBC-256 to encrypt the data in a file. To derive the AES key and IV pbkdf2 will be used to generate a 384 bit output using a given password and salt, where the first 256 bits will be the key and the last 128 will … Continue reading Is the following a secure method for file encryption?
I’m currently developing an Android Application that communicates with a server and needs the user to login.
The connection is secured with SSL and certificate pinning.
For user authentication I’m currently using challenge-response.
The se… Continue reading Challenge-Response authentication and SSL
Our Product Manager wants a 4 digit pin for login in our app, obviously for UX reasons, so user don’t have to remember their password each time when they login.
A refresh token can be retrieved from backend to obtain a session token, which… Continue reading Android: How safe is PBKDF2 with a 4 digit pin?
I was wondering if it’s possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication.
Ideally I would like to have their hashes instead of SHA-512 ones directly in /etc/shadow, but we all know what U… Continue reading Is it possible to use Argon2id hashes with PAM?
I am the creator of LessPass, a deterministic password generator.
The core of LessPass is not very complicated.
I have 2 methods calc_entropy and render_password:
calc_entropy transforms the master password + site + login into a very … Continue reading How can I calculate the entropy reduction in my system I’m going to introduce?
I read about recommendations about secret keys (or password as rfc8018 call it), one of them is to change the password from time to time.
I would like to know: is there some best practice for this change of password?
I found this referen… Continue reading What is the Best Practice to change a secret password with PBDKF2
I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?).
Same question asked here in 2014 but since a lot has changed since then, I would like to get feedback from experts on the latest best practices.
The problem
We need to hash credit card numbers to use as fingerprints. We’re aiming for the… Continue reading Safest alternative for hashing credit card numbers to use the hash as fingerprint?