Reference
Crypto and Secret Handling Reference
A lookup reference for secret generation, password hashing parameters, HMAC and JWTs, AES-GCM, PEM handling and entropy measures.
Randomness comes from a CSPRNG; entropy measures the search space. Password hashing uses a salted, slow key-derivation function. HMAC authenticates a message with a shared secret and JWT wraps claims in a signed token. AES-GCM encrypts and authenticates. PEM is a textual envelope for DER bytes. This reference groups the parameters and the limits for each.
01Quick reference
- Secrets: use crypto.getRandomValues; 128 bits is a common minimum, 256 bits for long-lived keys.
- PBKDF2-HMAC-SHA-256: hundreds of thousands of iterations or more; store the salt and iteration count with the hash.
- bcrypt: cost factor 12 or higher; Argon2id: tune memory, iterations and parallelism to about 0.5s on your hardware.
- HMAC: keyed hash over the message; compare tags in constant time.
- JWT: base64url header and payload plus a signature; the payload is readable, so never put a secret in it.
- AES-GCM: 96-bit nonce, never reused with the same key; the 128-bit tag detects tampering.
- PEM: BEGIN/END label plus base64 DER; a fingerprint is a hash of the DER, not a signature.
02Limitations
This reference summarises standards; it is not a substitute for the full specifications and omits key management, hardware security modules and asymmetric key exchange.
Frequently asked questions
- How many PBKDF2 iterations should I use?
- Use the highest count your login latency budget allows, refreshed over time; modern guidance starts in the hundreds of thousands of SHA-256 iterations. Prefer Argon2id or bcrypt for new password stores.
- What is the difference between HMAC and a signature?
- HMAC uses a shared secret, so any holder of the key can also forge a tag. A digital signature uses a private key to sign and a public key to verify, so the verifier cannot forge.
Sources
- NIST SP 800-63B: Digital Identity Guidelines — Authentication and Lifecycle Management — NIST (accessed 2026-10-05)
- RFC 8018: PKCS #5 — Password-Based Cryptography Specification v2.1 — IETF (accessed 2026-10-05)
- NIST SP 800-38D: GCM Recommendation — NIST (accessed 2026-10-05)