Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Password-based encryption takes a <em>password</em>, as the term implies. Passwords are run through a key derivation function to obtain the actual key. As a KDF is typically constructed from a hash function, the password may be of any length and contain any characters.</p> <p>Passwords have to be run through a KDF because typical passwords don't contain anywhere near enough entropy to be considered secure against brute force attacks. A KDF substitutes this lack of "key space" depth with computationally expensive key derivation – hence the thousands of iterations. The disadvantage is the fact that initializing the cipher is also expensive.</p> <p>This is a tradeoff well worth it if passwords are required instead of raw keys. However, in your case it would be a better idea to use the raw key. Unfortunately it seems that the Jasypt library you are using only supports PBE.</p> <p>To contain at least 256 bits of entropy (as much as a raw random 256-bit key), <a href="https://en.wikipedia.org/wiki/Password_strength#Random_passwords" rel="nofollow">the password has to contain at least 43 random (case-sensitive) alphanumeric characters</a>. If you pick a password that long, you can probably lower the iteration count to 1.</p> <p>It seems pretty odd to me that you have to think through all this even though you are using a library that you are supposed to be able to use "without the need of having deep knowledge on how cryptography works". Why does it expose all the ugly details if users aren't supposed to know what they are?</p>
    singulars
    1. This table or related slice is empty.
    1. POCreate a strong password for AES
      singulars
      1. PTQuestion
    1. PTAnswer
    1. This table or related slice is empty.
    1. USntoskrnl
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POCreate a strong password for AES
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTAcceptedByOriginator
    1. COThanks, very informative and helpful. It seems Jasypt has some defaults that probably make it good enough for the encryption ignorant (the basic text encryption uses MD5 and DES and strong uses MD5 and Triple DES, both with 1000 iterations). But they don't make it clear how good this is (or isn't), so I had to laugh at (and agree with) your assessment. I'll generate the password with KeePass to your specifications.
      singulars
      1. PO
      1. USPhilip
    2. CODES? Triple-DES? The authors must be total amateurs. DES can be brute forced on a home computer within days, and both DES and Triple-DES are slower than AES. MD5 is also considered broken for cryptographic use. Who knows what other amateur mistakes this library contains – I would stay away from it.
      singulars
      1. PO
      1. USntoskrnl
    3. COThanks again for the background and insight. I think I'd be safe with the above listed Bouncy Castle algorithm/implementation (SHA256 and AES 256, 1000 iterations), no? It's in line with this: http://www.jasypt.org/bouncy-castle.html. To be fair to Jasypt, it seems to be tackling integration (Hibernate, etc.), not encryption (delegates to JCE, Bouncy Castle). But as you recommend, I'll lower the iterations and increase the password to 43 character alphanumeric.
      singulars
      1. PO
      1. USPhilip
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload