pbkdf2

PBKDF2 with HMAC in Java

由 余生长醉 提交于 2019-12-07 06:08:58
问题 This question was migrated from Information Security Stack Exchange because it can be answered on Stack Overflow. Migrated 6 years ago . I am working on a Java project where I must ensure the confidentiality and integrity of users password saved in a plaintext file. To do so, I will write only a hash of the password in the file. More specifically, my intention is to write the hash of the password and a random salt, plus the random salt itself, to avoid the use of rainbow and lookup tables. I

RFC2898DeriveBytes implementation in Java

由 对着背影说爱祢 提交于 2019-12-06 17:30:56
问题 I have to decrypt a string encrypted in C# as a part of our project. This decryption is done using AES algorithm and packing mode as PKCS7. For generating the initialization vector they have used the following: Rfc2898DeriveBytes keyGenerator = new Rfc2898DeriveBytes("somestring", salt); The salt is the default bytes. This IV is used in encrypting the string using AES. I have read through some documents and found that AES can be implemented in Java. But not sure on how to pass the IV and

Rfc2898DeriveBytes + PBKDF2 + SecureString is it possible to use a secure string instead of a string?

由 ↘锁芯ラ 提交于 2019-12-06 03:41:39
问题 I've a function GetPassword , that returns a SecureString type. When I pass this secure string to Rfc2898DeriveBytes to generate a key, Visual Studio shows an error. My limited knowledge tells me that it is because Rfc2898DeriveBytes accepts only a string and not a secure string. Is there a workaround to this? //read the password from terminal Console.Write("Insert password"); securePwd = myCryptography.GetPassword(); //dont know why the salt is initialized like this byte[] salt = new byte[]

SHA3 status and PBKDF2-HMAC-SHA3 test vectors

由 血红的双手。 提交于 2019-12-05 16:16:48
Since SHA-3 seems to be an already known function (Keccak as the finalist of NIST hash function competition) I have several questions related to this topic: NIST site says that NIST is closed due to a lapse in government funding. Is there any chance that SHA-3 will ever be finally accepted? BouncyCastle library has an implementation of SHA-3 which digest results are the same as examples posted in wikipedia article (I tested this). Since the final standard is not approved, can this be trusted? Wikipedia says this is likely to be changed but how can it change as the final algorithm does not seem

Convert C# PBKDF2 using Rfc2898DeriveBytes to PHP

由 只愿长相守 提交于 2019-12-05 14:03:29
Long story short have a membership system built in .NET that we are porting to WordPress and need to replicate the PBKDF2 encryption so users don't need to reset their passwords. Using a know hashed password I've been able to replicate this in .NET easily, with the following code: static void Main(string[] args) { var isValid = CheckPassword("#0zEZcD7uNmv", "5SyOX+Rbclzvvit3MEM2nBRaPVo2M7ZTs7n3znXTfyW4OhwTlJLvpcUlCryblgkQ"); } public static int PBKDF2IterCount = 10000; public static int PBKDF2SubkeyLength = 256 / 8; // 256 bits public static int SaltSize = 128 / 8; // 128 bits private static

Java Cipher - PBE thread-safety issue

由 瘦欲@ 提交于 2019-12-05 08:46:01
It seems that I have a thread-safety issue with Cipher and/or PBEKeySpec. JDK : 1.8.0_102, 1.8.0_151 and 9.0.1+11 PBKDF2 algorithm: PBKDF2WithHmacSHA1 Cipher algorithm: AES/CFB/NoPadding Key algorithm: AES I know these classes aren't tread-safe if we use the same instances, but that's not the case, I'm getting a new instance at each decode. But even that, sometimes the decode fails, there is no exception, just an unexpected decoded value. I've been able to reproduce the problem: @Test public void shouldBeThreadSafe() { final byte[] encoded = { 27, 26, 18, 88, 84, -87, -40, -91, 70, -74, 87,

CipherOutputStream corrupting headers in Android

由 烈酒焚心 提交于 2019-12-05 07:12:29
问题 I'm using a simple CipherInput/OutputStream to try to encrypt/decrypt files in android. The problem I'm having is that it seems to be corrupting the first few bytes of the file but not the rest. Here's an example of an output from a simple text file: Original Text: "Test for Android cipher. The quick brown fox jumps over the lazy dog." Cycled through Encryption and Decryption: @ÍØJ­b¢çc°ÌHOšpher. The quick brown fox jumps over the the lazy dog. Here's my code: public static SecretKey

How can I hash a password in Tornado with minimal blocking?

由 只谈情不闲聊 提交于 2019-12-05 02:24:31
问题 I'm using PBKDF2, but this applies equally to BCrypt. Hashing a password with a reasonable number of iterations can easily block for 0.5 seconds. What is a lightweight way to take this out of process? I'm reluctant to setup something like Celery or Gearman just for this operation. 回答1: You could use a thread. This will not block tornado. Say that you have a handler that hashes passwords. Then the two relevant methods might look like this: import threading def on_message(self, message): # pull

RFC2898DeriveBytes implementation in Java

由 て烟熏妆下的殇ゞ 提交于 2019-12-04 22:45:48
I have to decrypt a string encrypted in C# as a part of our project. This decryption is done using AES algorithm and packing mode as PKCS7. For generating the initialization vector they have used the following: Rfc2898DeriveBytes keyGenerator = new Rfc2898DeriveBytes("somestring", salt); The salt is the default bytes. This IV is used in encrypting the string using AES. I have read through some documents and found that AES can be implemented in Java. But not sure on how to pass the IV and packing mode. Also, I have seen that there are modes CBC, ECB for mentioning the Cipher block mode. I am

How to validate Symfony2 sha512 passwords using nodejs

由 ≡放荡痞女 提交于 2019-12-04 20:20:33
I need to be able to validate in node some password which were generated and stored using Symfony2 with sha512 encoding. I can retrieve the hash and the salt just fine but when using crypto I cannot manage to generate a hash using the salt which matches the one stored in the database. Symfony security.yml security: encoders: "FOS\UserBundle\Model\UserInterface": sha512 Hash stored in DB 6zxwRZc4EPXKxQes9avs0ZyCRFkC4dtpXrT983ML8VLvv9WhRnAi282bwuFuj3LHPQBGmqD1BfCLDUXGdHIjZQ== Salt stored in DB qu7rjvaietws8kg4cgsggksookwsws8 As there is a salt on the node side I'm using crypto.pbkdf2Sync , there
订阅 pbkdf2