The tag has no usage guidance.

learn more… | top users | synonyms

13
votes
3answers
9k views

Is multiple encryption a good idea?

I know that many encryption algorithms, while secure, have vulnerabilities. To reduce risks, would multiple encryption like this Blowfish_CbC ( Rc2_OFB ( AES128_CBC (myfilecontent))) be a good ...
9
votes
2answers
3k views

“Official statement” on php.net : CRYPT_BLOWFISH is strongest hash algorithm. Why?

First: I asked this question on stackoverflow and was kindly asked to post this here again. See the original question here. According to the [early] doc pages of the new PHP 5.5 password ...
8
votes
1answer
3k views

PHP crypt() trims the salt as it would be too long

I am using Blowfish with PHP crypt() for password hashing but I noticed something weird. Quoting PHP documentation: CRYPT_BLOWFISH - Blowfish hashing with a salt as follows: "$2a$", "$2x$" or ...
5
votes
7answers
2k views

What is the best way to securely keep clear passwords?

I'm working on a web project that will connect to a database. For that, I will have to store the login/password of that database user in clear (encrypted in a symmetrical way) in order to be able to ...
4
votes
2answers
4k views

Why do most hashing functions produce hashes that have characters a-f 0-9?

This is something I never understood about hashing functions. I know that algorithms like whirlpool and blowfish both produce outputs that don't follow this pattern, but why is it that most do? Is ...
3
votes
2answers
663 views

Is mt_rand() suitable for generating a salt?

Assumed I have to following code in order to generate a random blowfish salt for saving a new password: $blowfishCharacters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./'; $salt ...
3
votes
2answers
1k views

Is AES(Rijndael) faster than Blowfish?

I know theoretical that blowfish is much faster than aes. But I benchmarked several algorithms including aes and blowfish for 1MB, 5MB, 10MB etc. files in java 8 platform and bouncy castle library. In ...
2
votes
3answers
386 views

Why PHP password_hash does use blowfish intstead threefish?

I was wondering why PHP's hash_password function use blowfish instead of threefish. According to Bruce Schneider blowfish is outdated and He is recommending twofish or threefish. Is blowfish enough ...
2
votes
2answers
429 views

In this example why do they hash a randomly generated piece of salt before hashing it with the password?

From here, in the code return substr(sha1(mt_rand()),0,22); what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append ...
1
vote
2answers
158 views

Why are application/services still using outdated Blowfish encryption? Is it secure?

For example, CrashPlan, an online backup service, is using 448-bit Blowfish to encrypt its backup files (only enterprise product line has the ability to choose using AES-256). According to Blowfish's ...
1
vote
2answers
448 views

How do you know if blowfish key is correct?

Encryption novice here so maybe this question makes no sense... Obviously if you know what the clear text is and it decrypts right, you have it. But if someone is running through keys to break the ...
1
vote
4answers
2k views

openssl blowfish key limited to 256 bits?

I get the following error if I give a key that is greater than 64 hex caracters (64*4=256 bits). According to this official document, blowfish is able to support key from 32 to 448 bits. ...
1
vote
1answer
2k views

How do I generate a blowfish password hash in Ubuntu?

What's the command line to generate a blowfish password hash? I can't seem to figure this out at all. Apache's htpasswd only supports bcrypt, and openssl passwd doesn't even do blowfish hahes (but it ...
1
vote
3answers
2k views

Preventing dictionary attacks against hashed passwords [duplicate]

Possible Duplicate: How to securely hash passwords? I have a website and on that website I use SHA-256 and salt my user's passwords. What I'm doing right now is padding each letter of the ...
1
vote
1answer
39 views

Can SSL using Blowfish cipher be considered strong enough?

I use OpenVPN to connect to a public VPN. Sometimes I connect from my college campus (it's fully open to alumni) and when this happens I can only use TCP SSL because the college network has a security ...
0
votes
1answer
625 views

How difficult is it to crack salt portion of hash

I write mobile application and I need to authenticate users against server. Server's side is written in php. I can't use cookies to store SID (Session ID), so I decided to send it at every request ...
0
votes
2answers
1k views

Bruteforcing blowfish

I am quite new to encryption and recently played around with blowfish (openssl's implemenation). I am using a 23 character password (case-sensitive alphanumeric random). I estimate the entropy to be ...