Questions tagged [rfc2898]

RFC 2898 issued by the IETF in 2000 is about "PKCS #5: Password-Based Cryptography Specification Version 2.0" and is mainly a republication of PKCS #5 v2.0 from RSA Laboratories' Public-Key Cryptography Standards (PKCS) series

Abstract from official RFC file:

This memo represents a republication of PKCS #5 v2.0 from RSA Laboratories' Public-Key Cryptography Standards (PKCS) series, and change control is retained within the PKCS process. The body of this document, except for the security considerations section, is taken directly from that specification.

This document provides recommendations for the implementation of password-based cryptography, covering key derivation functions, encryption schemes, message-authentication schemes, and ASN.1 syntax identifying the techniques.

The recommendations are intended for general application within computer and communications systems, and as such include a fair amount of flexibility. They are particularly intended for the protection of sensitive information such as private keys, as in PKCS #8 [25]. It is expected that application standards and implementation profiles based on these specifications may include additional constraints.

Other cryptographic techniques based on passwords, such as password-based key entity authentication and key establishment protocols [4][5][26] are outside the scope of this document. Guidelines for the selection of passwords are also outside the scope.

33 questions
1
vote
0 answers

Converting c# Rfc2898DeriveBytes encryption to PHP

Is there any functions in PHP that is equivalent to c# Rijndael AES encryption/decryption? I have include the c# code below. Please advise. protected string Encrypt(string clearText) { string EncryptionKey = "test"; byte[] clearBytes =…
JK9
  • 370
  • 2
  • 7
  • 26
1
vote
2 answers

Rfc2898DeriveBytes for java?

My backend server is based on .NET. On the server there is use Rfc2898DeriveBytes encryption This is the code of .Net public static string Encrypt(string clearText) { string EncryptionKey = "abc123"; byte[] clearBytes =…
WISHY
  • 11,067
  • 25
  • 105
  • 197
1
vote
1 answer

From C# encryption key derivation to Ruby (PBKDF2)

I'm trying to rewrite the following key generation method written in C# into its Ruby equivalent: private static byte[] CreateKey(string password, int length) { var salt = new byte[] { 0x01, 0x02, 0x23, 0x34, 0x37, 0x48,…
darius
  • 11
  • 2
1
vote
1 answer

Incrementing Rfc2898DeriveBytes IterationCount without original input

A lot of documents on the web related to Rfc2898DeriveBytes suggest that the number of iterations should be increased every two years. I am designing a new database structure for an application to contain the number of iterations with the hash and…
Jack
  • 35
  • 8
1
vote
2 answers

Why is the output for hash_pbkdf2 (PHP) different than the .NET / C# implementation

In a small project of mine i need to calculate the hash of a function. I have a working example of PHP hash $pass = "123456"; $mysalt = strrev($pass); echo hash_pbkdf2('sha1', $pass, $mysalt, 1000, 32); //using the PHP inbuilt function echo…
Parimal Raj
  • 20,189
  • 9
  • 73
  • 110
1
vote
2 answers

C# to PHP AES Decryption

Hi i have c# sample of code but i can't turn it to php. İ tried to rewrite code but i can't do it. In my project other server encrypts data with c# and i have to decrypt it using PHP. I have password and salt value. Here is C# code includes encrypt…
renatgad
  • 13
  • 4
0
votes
1 answer

RFC2898DeriveBytes implementation in Java

I have to decrypt a string encrypted in C# as a part of our project. This decryption is done using AES algorithm and packing mode as PKCS7. For generating the initialization vector they have used the following: Rfc2898DeriveBytes keyGenerator = new…
VamsiKrishna
  • 751
  • 6
  • 14
  • 29
0
votes
1 answer

How many bytes should a password hash be when using Rfc2898DeriveBytes?

I have a hashing function below, is 128 byte hash for password overkill or underkill? public string HashPassword(string password) { Rfc2898DeriveBytes rfc = new( password, _salt, _iterations, _hashAlgorithmName …
rencedm112
  • 397
  • 3
  • 11
0
votes
1 answer

How to use CryptoJS in Angular 9 to get same encrypted string like C# Rfc2898DeriveBytes

I am trying to convert below C# code to angular 9 using CryptoJS because when I tried to convert C# code to angular, it gives different encrypted string. How to convert C# code using Rfc2898DeriveBytes into angular 9 using CryptoJS? C# code: public…
Darshana
  • 662
  • 1
  • 10
  • 29
0
votes
1 answer

Create method like System.Web.Helpers.Crypto.HashPassword (ASP.NET) in nodejs?

How can I make password hash using RFC 2898 like https://learn.microsoft.com/en-us/previous-versions/aspnet/web-frameworks/gg538287(v=vs.111) in nodejs? My nodejs app are using a table of SQL server which have password field hashed by…
Kuong Knight
  • 115
  • 1
  • 11
0
votes
1 answer

Replicating Asp.net Identity Password Hash to Chilkat

Hi I want to replicate the password hashing that is done in asp.net identity such that, the resulting value of password hashed by asp.net identity and the password hashed by Chilkat are same. Is that even possible? In C# asp.net, we use…
Samra
  • 1,815
  • 4
  • 35
  • 71
0
votes
1 answer

Issue With Encrypted Password in C# using Rfc2898DeriveBytes and MSSQL

I have made a login system for my application, however, it is working extremely inconsistently. Sometimes the password will work, but other times it says it's incorrect. I'm 100% sure I'm typing it correctly. To store the passwords, I generate a…
Robert Woods
  • 350
  • 1
  • 6
  • 17
0
votes
1 answer

C# bcrypt and pbkdf2 verify password function difference

According this reference source code, the function SlowEquals private static bool SlowEquals(byte[] a, byte[] b) { uint diff = (uint)a.Length ^ (uint)b.Length; for (int i = 0; i < a.Length && i < b.Length; i++) diff…
JimNeo
  • 23
  • 6
0
votes
1 answer

Breaking Rfc2898DeriveBytes key with input password but without salt

I am using C# RijndaelManaged class for AES encryption. The key and IV are generated from input password and salt using Rfc2898DeriveBytes class. My question is, how difficult would it be to break encryption if someone obtained input password but…
SoftwareFactor
  • 8,430
  • 3
  • 30
  • 34
0
votes
1 answer

Letting Rfc2898DeriveBytes calculate the salt

I've read a lot of posting here about Rfc2898DeriveBytes() and it seems that in all of them, the salt is pre-calculated and passed to the constructor. However, there is a constructor that accepts a salt length input, and the salt will be calculated…
Elroy Flynn
  • 3,032
  • 1
  • 24
  • 33