Is it safe to reuse the password when using AES-CTR with scrypt?What is the best-practice for encrypting small files?Single-purpose symmetric encryption scheme for single filesProper way of doing encryption and authentication (PBKDF2 + AES)CTR HMAC SHA256 implementationnonce of AES-GCM in SSLBest practises to generate IV for AES-CTR in this scenarioWhat is a safe maximum message size limit when encrypting files to disk with AES-GCM before the need to re-generate the key or NONCEIs it safe to store both the AES-related data and the PBKDF2-related data (except passwords) in one file?Is it safe to use unauthenticated AES CBC when encrypting random bytes?
Can my Boyfriend, who lives in the UK and has a Polish passport, visit me in the USA?
What is the evidence on the danger of feeding whole blueberries and grapes to infants and toddlers?
Find Two largest numbers in a list without using Array
Is there such a thing as too inconvenient?
How could Tony Stark wield the Infinity Nano Gauntlet - at all?
Can a Beast Master ranger choose a swarm as an animal companion?
Why don't politicians push for fossil fuel reduction by pointing out their scarcity?
My two team members in a remote location don't get along with each other; how can I improve working relations?
Levenshtein Neighbours
Is "stainless" a bulk or a surface property of stainless steel?
Unity: transform.LookAt(target) not "looking at" target?
Count the frequency of items in an array
Why do some academic journals requires a separate "summary" paragraph in addition to an abstract?
Are there categories whose internal hom is somewhat 'exotic'?
Earliest evidence of objects intended for future archaeologists?
What animal has fat with the highest energy density?
TechSupport Issue ID#812
What happened after the end of the Truman Show?
Why didn’t Doctor Strange stay in the original winning timeline?
Do living authors still get paid royalties for their old work?
Did the twin engined Lazair ultralight have a throttle for each engine?
Homogeneous Equations and Linear Algebra
How to translate 脑袋短路 into English?
How to dismiss intrusive questions from a colleague with whom I don't work?
Is it safe to reuse the password when using AES-CTR with scrypt?
What is the best-practice for encrypting small files?Single-purpose symmetric encryption scheme for single filesProper way of doing encryption and authentication (PBKDF2 + AES)CTR HMAC SHA256 implementationnonce of AES-GCM in SSLBest practises to generate IV for AES-CTR in this scenarioWhat is a safe maximum message size limit when encrypting files to disk with AES-GCM before the need to re-generate the key or NONCEIs it safe to store both the AES-related data and the PBKDF2-related data (except passwords) in one file?Is it safe to use unauthenticated AES CBC when encrypting random bytes?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
$begingroup$
I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does:
scrypt encrypted data format
----------------------------
offset length
0 6 "scrypt"
6 1 scrypt data file version number (== 0)
7 1 log2(N) (must be between 1 and 63 inclusive)
8 4 r (big-endian integer; must satisfy r * p < 2^30)
12 4 p (big-endian integer; must satisfy r * p < 2^30)
16 32 salt
48 16 first 16 bytes of SHA256(bytes 0 .. 47)
64 32 HMAC-SHA256(bytes 0 .. 63)
96 X data xor AES256-CTR key stream generated with nonce == 0
96+X 32 HMAC-SHA256(bytes 0 .. 96 + (X - 1))
AES256-CTR is computed with a 256-bit AES key key_enc, and HMAC-SHA256 is
computed with a 256-bit key key_hmac, where
scrypt(password, salt, N, r, p, 64) == [key_enc][key_hmac]
Can I safely reuse the password for encrypting different files? I'm concerned that nonce is set to 0 and I know that reusing the key in the CTR mode is a big no-no. However, the key is generated by scrypt, which uses randomly generated salt. Is that enough to mitigate the problems with reusing the passphrase and having a fixed nonce?
aes ctr scrypt
asked 8 hours ago
mihaomihao
1063 bronze badges
New contributor
mihao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$endgroup$
add a comment |
$begingroup$
I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does:
scrypt encrypted data format
----------------------------
offset length
0 6 "scrypt"
6 1 scrypt data file version number (== 0)
7 1 log2(N) (must be between 1 and 63 inclusive)
8 4 r (big-endian integer; must satisfy r * p < 2^30)
12 4 p (big-endian integer; must satisfy r * p < 2^30)
16 32 salt
48 16 first 16 bytes of SHA256(bytes 0 .. 47)
64 32 HMAC-SHA256(bytes 0 .. 63)
96 X data xor AES256-CTR key stream generated with nonce == 0
96+X 32 HMAC-SHA256(bytes 0 .. 96 + (X - 1))
AES256-CTR is computed with a 256-bit AES key key_enc, and HMAC-SHA256 is
computed with a 256-bit key key_hmac, where
scrypt(password, salt, N, r, p, 64) == [key_enc][key_hmac]
Can I safely reuse the password for encrypting different files? I'm concerned that nonce is set to 0 and I know that reusing the key in the CTR mode is a big no-no. However, the key is generated by scrypt, which uses randomly generated salt. Is that enough to mitigate the problems with reusing the passphrase and having a fixed nonce?
aes ctr scrypt
asked 8 hours ago
mihaomihao
1063 bronze badges
New contributor
mihao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$endgroup$
$begingroup$
related What is the best-practice for encrypting small files?
$endgroup$
– kelalaka
5 hours ago
add a comment |
$begingroup$
I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does:
scrypt encrypted data format
----------------------------
offset length
0 6 "scrypt"
6 1 scrypt data file version number (== 0)
7 1 log2(N) (must be between 1 and 63 inclusive)
8 4 r (big-endian integer; must satisfy r * p < 2^30)
12 4 p (big-endian integer; must satisfy r * p < 2^30)
16 32 salt
48 16 first 16 bytes of SHA256(bytes 0 .. 47)
64 32 HMAC-SHA256(bytes 0 .. 63)
96 X data xor AES256-CTR key stream generated with nonce == 0
96+X 32 HMAC-SHA256(bytes 0 .. 96 + (X - 1))
AES256-CTR is computed with a 256-bit AES key key_enc, and HMAC-SHA256 is
computed with a 256-bit key key_hmac, where
scrypt(password, salt, N, r, p, 64) == [key_enc][key_hmac]
Can I safely reuse the password for encrypting different files? I'm concerned that nonce is set to 0 and I know that reusing the key in the CTR mode is a big no-no. However, the key is generated by scrypt, which uses randomly generated salt. Is that enough to mitigate the problems with reusing the passphrase and having a fixed nonce?
aes ctr scrypt
asked 8 hours ago
mihaomihao
1063 bronze badges
New contributor
mihao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$endgroup$
I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does:
scrypt encrypted data format
----------------------------
offset length
0 6 "scrypt"
6 1 scrypt data file version number (== 0)
7 1 log2(N) (must be between 1 and 63 inclusive)
8 4 r (big-endian integer; must satisfy r * p < 2^30)
12 4 p (big-endian integer; must satisfy r * p < 2^30)
16 32 salt
48 16 first 16 bytes of SHA256(bytes 0 .. 47)
64 32 HMAC-SHA256(bytes 0 .. 63)
96 X data xor AES256-CTR key stream generated with nonce == 0
96+X 32 HMAC-SHA256(bytes 0 .. 96 + (X - 1))
AES256-CTR is computed with a 256-bit AES key key_enc, and HMAC-SHA256 is
computed with a 256-bit key key_hmac, where
scrypt(password, salt, N, r, p, 64) == [key_enc][key_hmac]
Can I safely reuse the password for encrypting different files? I'm concerned that nonce is set to 0 and I know that reusing the key in the CTR mode is a big no-no. However, the key is generated by scrypt, which uses randomly generated salt. Is that enough to mitigate the problems with reusing the passphrase and having a fixed nonce?
aes ctr scrypt
aes ctr scrypt
asked 8 hours ago
mihaomihao
1063 bronze badges
New contributor
mihao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 8 hours ago
mihaomihao
1063 bronze badges
New contributor
mihao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 8 hours ago
mihao
asked 8 hours ago
mihaomihao
1063 bronze badges
New contributor
mihao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 8 hours ago
mihaomihao
1063 bronze badges
asked 8 hours ago
mihaomihao
1063 bronze badges
1063 bronze badges
New contributor
mihao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
mihao is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$begingroup$
related What is the best-practice for encrypting small files?
$endgroup$
– kelalaka
5 hours ago
add a comment |
$begingroup$
related What is the best-practice for encrypting small files?
$endgroup$
– kelalaka
5 hours ago
$begingroup$
related What is the best-practice for encrypting small files?
$endgroup$
– kelalaka
5 hours ago
$begingroup$
related What is the best-practice for encrypting small files?
$endgroup$
– kelalaka
5 hours ago
add a comment |
1 Answer
1
active
oldest
votes
$begingroup$
CTR is insecure if you reuse a key/iv pair. Since the salt is random, a different encryption key will be derived every time you encrypt something. Therefore it is safe even if it always uses the zero IV. Of course, the password must be strong enough to resist brute force attacks.
answered 7 hours ago
ConradoConrado
3,66815 silver badges30 bronze badges
$endgroup$
1
$begingroup$
This paper supports this answer. (It explicitly says that deterministic encryption is fine for salt-randomizing password-based encryption)
$endgroup$
– SEJPM♦
4 hours ago
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "281"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
mihao is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f72689%2fis-it-safe-to-reuse-the-password-when-using-aes-ctr-with-scrypt%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
$begingroup$
CTR is insecure if you reuse a key/iv pair. Since the salt is random, a different encryption key will be derived every time you encrypt something. Therefore it is safe even if it always uses the zero IV. Of course, the password must be strong enough to resist brute force attacks.
answered 7 hours ago
ConradoConrado
3,66815 silver badges30 bronze badges
$endgroup$
1
$begingroup$
This paper supports this answer. (It explicitly says that deterministic encryption is fine for salt-randomizing password-based encryption)
$endgroup$
– SEJPM♦
4 hours ago
add a comment |
$begingroup$
CTR is insecure if you reuse a key/iv pair. Since the salt is random, a different encryption key will be derived every time you encrypt something. Therefore it is safe even if it always uses the zero IV. Of course, the password must be strong enough to resist brute force attacks.
answered 7 hours ago
ConradoConrado
3,66815 silver badges30 bronze badges
$endgroup$
1
$begingroup$
This paper supports this answer. (It explicitly says that deterministic encryption is fine for salt-randomizing password-based encryption)
$endgroup$
– SEJPM♦
4 hours ago
add a comment |
$begingroup$
CTR is insecure if you reuse a key/iv pair. Since the salt is random, a different encryption key will be derived every time you encrypt something. Therefore it is safe even if it always uses the zero IV. Of course, the password must be strong enough to resist brute force attacks.
answered 7 hours ago
ConradoConrado
3,66815 silver badges30 bronze badges
$endgroup$
CTR is insecure if you reuse a key/iv pair. Since the salt is random, a different encryption key will be derived every time you encrypt something. Therefore it is safe even if it always uses the zero IV. Of course, the password must be strong enough to resist brute force attacks.
answered 7 hours ago
ConradoConrado
3,66815 silver badges30 bronze badges
answered 7 hours ago
ConradoConrado
3,66815 silver badges30 bronze badges
answered 7 hours ago
ConradoConrado
3,66815 silver badges30 bronze badges
answered 7 hours ago
ConradoConrado
3,66815 silver badges30 bronze badges
3,66815 silver badges30 bronze badges
1
$begingroup$
This paper supports this answer. (It explicitly says that deterministic encryption is fine for salt-randomizing password-based encryption)
$endgroup$
– SEJPM♦
4 hours ago
add a comment |
1
$begingroup$
This paper supports this answer. (It explicitly says that deterministic encryption is fine for salt-randomizing password-based encryption)
$endgroup$
– SEJPM♦
4 hours ago
1
1
$begingroup$
This paper supports this answer. (It explicitly says that deterministic encryption is fine for salt-randomizing password-based encryption)
$endgroup$
– SEJPM♦
4 hours ago
$begingroup$
This paper supports this answer. (It explicitly says that deterministic encryption is fine for salt-randomizing password-based encryption)
$endgroup$
– SEJPM♦
4 hours ago
add a comment |
mihao is a new contributor. Be nice, and check out our Code of Conduct.
mihao is a new contributor. Be nice, and check out our Code of Conduct.
mihao is a new contributor. Be nice, and check out our Code of Conduct.
mihao is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Cryptography Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
Use MathJax to format equations. MathJax reference.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f72689%2fis-it-safe-to-reuse-the-password-when-using-aes-ctr-with-scrypt%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
$begingroup$
related What is the best-practice for encrypting small files?
$endgroup$
– kelalaka
5 hours ago