pbkdf2 | Adding PBKDF2 hashing for customer and admin-user passwords | Identity Management library

HKDF is defined in RFC5869. It is intended to generate keys from some cryptographically secure "keying material" (IKM). It is not intended for stretching a human-generated password. As discussed in section 4 Applications of HKDF:

On the other hand, it is anticipated that some applications will not be able to use HKDF "as-is" due to specific operational requirements, or will be able to use it but without the full benefits of the scheme. One significant example is the derivation of cryptographic keys from a source of low entropy, such as a user's password. The extract step in HKDF can concentrate existing entropy but cannot amplify entropy. In the case of password-based KDFs, a main goal is to slow down dictionary attacks using two ingredients: a salt value, and the intentional slowing of the key derivation computation. HKDF naturally accommodates the use of salt; however, a slowing down mechanism is not part of this specification. Applications interested in a password-based KDF should consider whether, for example, [PKCS5] meets their needs better than HKDF.

I don't believe that CryptoKit offers a PBKDF of any kind (PBKDF2, scrypt, bcrypt, argon2). It's a very limited framework (I have yet to find a situation where it was useful). You will likely need to continue to use CommonCrypto for this, or implement it yourself (or use something like CryptoSwift, which I believe implements several).

For completeness, moving the answer from @Clement in a comment to an answer:

This error can happen when loading the oscrypto (libcrypto) if the memory usage is too high. The OOM state cascades upward.

The issue is that your pip version is too old to install one of this project's subdependencies, cryptography, which is using newer features.

Upgrading pip with the following will make it possible to install this package:

PBKDF2 is designed to reduce brute-force attacks by increasing computational cost. It is not intended to resolve problem of sending plaintext password - this should be done by other security mechanism - secure communication (i.e. TLS 1.3).

If secure communication is broken, then it does not matter if you have sent plaintext or hash of the password.

What you are referring as NONCE should be called SALT.

Basically, PBKFD2:

1. Takes any data you send (i.e. password)
2. Adds SALT
3. Applies PRF (Pseudo-Random Function) number of times
4. Returns n-bits of derived password

So, answering your questions:

1. It is ok to run PBKDF2 twice, however I would increase number of iterations, rather than run it twice
2. 100,000 is reasonable number of iterations
3. 24 bytes (192 bits) is reasonable hash size. Although you are using HMACSHA512 as PFR which produces hash of size 512 bits.
4. PBKDF2 standard allows 8 bytes SALT, however NIST recommends min. 16 bytes - I would increase SALT size
5. As mentioned earlier, you can run PBKDF2 on any string input. In most cases it would be password or passphrase

django-allauth requires cryptography which now requires Rust to compile. You could try updating your Dockerfile with the newer python release, i.e. FROM python:3.8.8-alpine, which might let it fetch the prebuilt binary for cryptography.

If that doesn't work you need to add the Rust dependencies so it can compile the package.

The problem is SALT.getBytes().

This gets you the raw byte value of the salt.

However, it seems like the salt is encoded with Base64 (Base64 often appends =-signs so that the length matches, this can often be used to detect Base64).

From the online encrypter you use:

Input Base64 Empty salt will generate a random 16 bits salt value

You can use this to decode the Base64-salt:

Instead of this

The following issues exist in the Dart code:

• The WebCryptoAPI code concatenates the GCM tag with the ciphertext in the order ciphertext | tag. In the Dart code, both parts have to be separated accordingly.
  Also, in the Dart code, the nonce/IV is not taken into account. A possible fix of decrypt() is:

In the C# code there are the following issues:

• Salt and IV must be hex decoded (and not UTF8 encoded).
• numKeyBytes specifies the key size in bytes and is therefore 16 (and not 128) for AES-128.
• aes.KeySize specifies the key size in bits and is therefore numKeyBytes * 8 (and not numKeyBytes), but can alternatively be omitted.
• For aes.BlockSize, aes.Mode and aes.Padding the default values are used (128, CBC, PKCS7), so they do not need to be specified explicitly.
• encryptedText must be Base64 decoded.

A possible implementation is: