Encrypting variable-length passwords to yield fixed-length encrypted passwords
According to one embodiment, encrypting passwords includes performing the following for each input password of a plurality of input passwords to yield encrypted passwords, where at least two input passwords have different lengths and the encrypted passwords have the same length. An input password and a random number are received at logic configured to perform a key derivation operation comprising a pseudorandom function. An encryption key is derived from the input password and the random number according to the key derivation operation. The encryption key and a user identifier are received at logic configured to perform a cipher-based message authentication code (CMAC) function. An encrypted password is generated from the encryption key and the user identifier according to the CMAC function.
1. A method comprising:
performing the following for each input password of a plurality of input passwords to yield a plurality of encrypted passwords, at least two input passwords having different lengths, the encrypted passwords having the same length:
receiving an input password and a random number at logic configured to perform a key derivation operation, the key derivation operation comprising a pseudorandom function;
deriving an encryption key from the input password and the random number according to the key derivation operation;
receiving the encryption key and a user identifier at logic configured to perform a cipher-based message authentication code (CMAC) function; and
generating an encrypted password from the encryption key and the user identifier according to the CMAC function.
2. The method of claim 1 , the random number further comprising a time of day when the encryption key is derived.
3. The method of claim 1 , further comprising:
padding the user identifier to make a total length of the user identifier equal to a length of the encryption key.
4. The method of claim 1 , further comprising:
truncating the encrypted password to yield a truncated encrypted password.
5. The method of claim 1 , further comprising:
recording the random number;
receiving the input password a second time; and
generating the encryption key again from the recorded random number and the input password received the second time.
6. The method of claim 1 , further comprising:
receiving an iteration count at the logic configured to perform the key derivation operation; and
iterating of the pseudorandom function of the key derivation operation a number of times indicated by the iteration count.
7. The method of claim 1 , the CMAC function further comprising an Advanced Encryption Standard (AES)-CMAC function.
8. The method of claim 1 , the key derivation operation further comprising a Password-Based Key Derivation Function 2 (PBKDF2).
9. The method of claim 1 , the pseudorandom function further comprising a Hash Message Authentication Code-Secure Hash Algorithm-1 (HMAC-SHA1) function.
10. An apparatus comprising:
a memory configured to:
store logic configured to perform a key derivation operation, the key derivation operation comprising a pseudorandom function; and
store logic configured to perform a cipher-based message authentication code (CMAC) function; and
a processor configured to perform the following for each input password of a plurality of input passwords to yield a plurality of encrypted passwords, at least two input passwords having different lengths, the encrypted passwords having the same length:
receive an input password and a random number;
derive an encryption key from the input password and the random number according to the key derivation operation;
receive the encryption key and a user identifier; and
generate an encrypted password from the encryption key and the user identifier according to the CMAC function.
11. The apparatus of claim 10 , the random number further comprising a time of day when the encryption key is derived.
12. The apparatus of claim 10 , the processor further configured to:
pad the user identifier to make a total length of the user identifier equal to a length of the encryption key.
13. The apparatus of claim 10 , the processor further configured to:
truncate the encrypted password to yield a truncated encrypted password.
14. The apparatus of claim 10 , the processor further configured to:
record the random number;
receive the input password a second time; and
generate the encryption key again from the recorded random number and the input password received the second time.
15. The apparatus of claim 10 , the processor further configured to:
receive an iteration count at the logic configured to perform the key derivation operation; and
iterate of the pseudorandom function of the key derivation operation a number of times indicated by the iteration count.
16. The apparatus of claim 10 , the CMAC function further comprising an Advanced Encryption Standard (AES)-CMAC function.
17. The apparatus of claim 10 , the key derivation operation further comprising a Password-Based Key Derivation Function 2 (PBKDF2).
18. The apparatus of claim 10 , the pseudorandom function further comprising a Hash Message Authentication Code-Secure Hash Algorithm-1 (HMAC-SHA-1) function.
19. A computer-readable medium storing logic when executed by a processor configured to:
perform the following for each input password of a plurality of input passwords to yield a plurality of encrypted passwords, at least two input passwords having different lengths, the encrypted passwords having the same length:
receive an input password and a random number at logic configured to perform a key derivation operation, the key derivation operation comprising a pseudorandom function;
derive an encryption key from the input password and the random number according to the key derivation operation;
receive the encryption key and a user identifier at logic configured to perform a cipher-based message authentication code (CMAC) function; and
generate an encrypted password from the encryption key and the user identifier according to the CMAC function.
20. The computer-readable medium of claim 19 , the random number further comprising a time of day when the encryption key is derived.
21. The computer-readable medium of claim 19 , the logic further configured to:
pad the user identifier to make a total length of the user identifier equal to a length of the encryption key.
22. The computer-readable medium of claim 19 , the logic further configured to:
truncate the encrypted password to yield a truncated encrypted password.
23. The computer-readable medium of claim 19 , the logic further configured to:
record the random number;
receive the input password a second time; and
generate the encryption key again from the recorded random number and the input password received the second time.
24. The computer-readable medium of claim 19 , the logic further configured to:
receive an iteration count at the logic configured to perform the key derivation operation; and
iterate of the pseudorandom function of the key derivation operation a number of times indicated by the iteration count.
25. The computer-readable medium of claim 19 , the CMAC function further comprising an Advanced Encryption Standard (AES)-CMAC function.
26. The computer-readable medium of claim 19 , the key derivation operation further comprising a Password-Based Key Derivation Function 2 (PBKDF2).
27. The computer-readable medium of claim 19 , the pseudorandom function further comprising a Hash Message Authentication Code-Secure Hash Algorithm-1 (HMAC-SHA-1) function.