How to Configure .NET’s PBKDF2 Implementation in 2019
How to Configure .NET's PBKDF2 Implementation in 2019 I want to use .NET's Rfc2898DeriveBytes functionality to store passwords in a database. In order to do so, I need to make…
Determining the Optimal Number of PBKDF2 Iterations for Technology Evolution
Determining the Optimal Number of PBKDF2 Iterations for Technology EvolutionWhen it comes to using PBKDF2 to derive passwords, the question of what constitutes a "sufficient" iteration count often arises. However,…
Best Practices for Client-Side Password Hashing with PBKDF2
Best Practices for Client-Side Password Hashing with PBKDF2 First, make sure you read this answer to the question "Client side password hashing", paying particular attention to the last paragraph. Also,…
Is it Safe to Use an ECDSA Public Key as a Password Seed for GCM/AES?
Is it Safe to Use an ECDSA Public Key as a Password Seed for GCM/AES? This seems... confused. PBKDF2 is a Password-Based Key Derivation Function. It is used to process…
What Went Wrong with Blackberry’s Encryption?
What Went Wrong with Blackberry's Encryption? The NIST defines a vulnerability in RIM Blackberry encryption discovered last October. Apparently, Blackberry's flavour of PBKDF2 was weak. They say: The offline backup…
Choosing a Password Hashing Method: Bcrypt, Scrypt, and More
Choosing a Password Hashing Method: Bcrypt, Scrypt, and MoreIn cryptography, "new" is not synonymous to "good". That bcrypt is twelve years old (12 years... is that really "old" ?) just…
Using PBKDF2-based System.Cryptology.RFC2898DeriveBytes() for Unicode Password Hashing
Using PBKDF2-based System.Cryptology.RFC2898DeriveBytes() for Unicode Password Hashing The NIST approves of PBKDF2 when hashing and storing passwords, although it was not originally intended for this purpose. Notably, StackExchange also uses…