A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
0
votes
1answer
33 views
After salting my passwords, are they protected against dictionary attacks? [duplicate]
I use sha1() to hash my users passwords, but recently a friend told me that if someone get the hash then they could use dictionary attack and he recommended using salts.
I implemented a random salt ...
1
vote
3answers
87 views
Why are MD5 collisions dangerous?
I understand that the MD5 algorithm isn't collision resistant, and that collisions between data of arbitrary size can be found with more efficient methods than brute-forcing.
However, I have read ...
-6
votes
1answer
49 views
How to determine decrypt type? [closed]
That my excryptyion: $apr1$Xd.M80Hx$CMwMdjv79eiE4PfFjuI8R.
How should I determine the current encryption?
Thanks you people.
1
vote
0answers
37 views
When using HMAC, does key encoding matter? [migrated]
Given:
H is a good hash function with block size L.
K is a key of length >= L (recommended by RFC 2104).
Khex and Kbase64 are ASCII encodings of K.
In the HMAC algorithm, is there a good reason to ...
5
votes
3answers
132 views
Does hashing a PRNG make it cryptographically secure?
Would hashing the result of a regular random number generator produce a cryptographically secure PRNG?
For example, would sha1(rand()) effectively be a secure PRNG?
Assuming it doesn't, how would ...
2
votes
3answers
57 views
User specified iteration count
I'm working on a PHP authentication and registration system following the standard salt+password = 'auth hash' and using the plaintext/unencrypted username as the lookup field on the initial query. ...
5
votes
2answers
194 views
Why is 8ms a goal for hashing?
I'm currently developing a small project in PHP, and as it involves user authentication, I've been researching what options I've got regarding hashing. I've settled on PBKDF2 primarily due to it's ...
0
votes
0answers
5 views
HMAC and assumptions on the cryptographic hash [migrated]
According to Wikipedia, a cryptographic hash function has the following properties:
Pre-image resistance: Given h, it's difficult to find any message m such that h = H(m).
Second pre-image ...
-2
votes
0answers
48 views
Unable to understand Word 2007 document encryption [closed]
So I read the documentation here:
It seems there are 3 principal modes of encryption. I created a mock document and made it password protected. After some snooping, I guess my document uses the RC4 ...
2
votes
1answer
112 views
Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]
In my school everyone must change their password every six months.
The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...
0
votes
2answers
105 views
Why store the password salt instead of generating it? [duplicate]
So, reading through this article: http://crackstation.net/hashing-security.htm it says that storing the salt is fine in plain text because it renders the lookup/rainbow tables ineffective. I get that, ...
8
votes
7answers
378 views
Why should I hash passwords?
I've read that every good web application should hash passwords. I found many articles about hashing.
So I started implementing hashing on my website and then I asked myself why should I do it? When a ...
-1
votes
1answer
48 views
Properties for cryptographic hash functions (preimage, second preimage and collision resistant)
While studying computer security at university I have been asked this question:
There are three desirable properties for cryptographic hash functions: Preimage resistant, Second preimage resistant, ...
0
votes
1answer
56 views
Cryptographic Hash Function Analysis [closed]
I am planning on writing an essay regarding the strength, reliability and speed of various cryptographic hashing functions. In order to do so, I need to run an experiment on the algorithms in order to ...
0
votes
0answers
29 views
How can I determine the encryption used by knowing input and result? [duplicate]
Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
-4
votes
1answer
92 views
the Informix password crack
I get some hash like:
username sowainformix
salt 7307821250330563328
hashed_password HaHvvzanjp_lPZgHLu0KHquN.Q4t98EF48csXk1QTJs
hash_type SHA-256
updated
flags ...
-3
votes
0answers
96 views
Is there going to be SHA-4? [closed]
After the recent results of the SHA-3 competition (resulting in keccak being the winner), and apparently there not being a great deal of difference in results between keccak and SHA-512, will there ...
6
votes
2answers
153 views
Does the md5 (or any hash for that matter) of a string include the null terminator?
Does the md5 (or any hash for that matter) of a string include the null terminator in its calculations? That is does the hash of a string equal the hash of the sequence of bytes that represents the ...
7
votes
1answer
137 views
“Official statement” on php.net : CRYPT_BLOWFISH is strongest hash algorithm. Why?
First: I asked this question on stackoverflow and was kindly asked to post this here again. See the original question here.
According to the [early] doc pages of the new PHP 5.5 password ...
4
votes
2answers
110 views
Do SSD's offer significant performance boost for Scrypt?
Being a memory intensive hash, I was wondering if SSD's offer any appreciable performance boost for brute force attacks.
2
votes
2answers
41 views
Does glibc2 version of the crypt function still use DES for alternative hashing methods?
I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
-1
votes
3answers
133 views
Salting in encryption (rather than hashing)
I am aware of the benefits of adding a salt to values that are hashed using a one-way function. Is adding a salt to a value that is being encrypted (using symmetric encryption) considered to be good ...
2
votes
4answers
188 views
When salting and hashing passwords, any advantage to including password length?
In this answer, Gilles says (emphasis mine):
There's no need to hide the salt from the attacker: it needs to be unique (and not derived from the password) but it doesn't need to be more secret ...
25
votes
7answers
3k views
Is salting a hash really as secure as common knowledge implies?
(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.)
I'm implementing a salt function for user passwords ...
2
votes
1answer
145 views
What is the collision chance of a 128-bit hashing function if it is always fed with 256-bits of data?
I mean "normal" collisions not based on any attack.
How do i calculate it?
4
votes
1answer
86 views
Could a password hash that's prone to more collisions provide better overall security?
Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
4
votes
2answers
147 views
HMACSHA512 versus Rfc2898DeriveBytes for password hash
We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key
The salt is 64 char randomly generated string.
We allocated 2048 length on the database for the hashed base64 string ...
5
votes
1answer
97 views
Is the execution time for bcrypt independent of the length of the input string?
Is the execution time for bcrypt independent of the length of the input string?
i.e.
Should the execution time of
bcrypt.hashpw('input_string', bcrypt.gensalt(12))
and
...
0
votes
1answer
128 views
How secure is my private key in the Windows Digital Certificate store?
Many files we download don't have digital signatures. Files may get infected or someone may intentionally modify them on our hard disk.
So I wrote a simple file hashing program in c# that creates a ...
0
votes
3answers
116 views
Why one time passwords using nested hash chain are not used?
I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
0
votes
2answers
79 views
Does hash solve passwords in parts?
From an answer this earlier question: Does adding dictionary words to passwords weaken them?
"...you have no way to recognize it as a password before testing it
(against a hash or an online ...
3
votes
1answer
79 views
Are there any uses of having a non-deterministic salt value for hashes?
So I've been toying with the idea of having non-deterministic salt values for hashes.
Let me explain what I mean:
Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
2
votes
1answer
71 views
Hash extension(padding) attack
I recently came across this website talking about sha1 padding attack.
http://www.vnsecurity.net/2010/03/codegate_challenge15_sha1_padding_attack/
After reading here are some of my doubts:
How ...
3
votes
1answer
152 views
How to determine hashes/second in password cryptanalysis
I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt.
I'd like to ...
4
votes
2answers
136 views
Truncating the output of SHA256 to 128 bits
suppose we need/prefer 128 bit hash output. for example to generate a 128 bit encryption key or, in other applications (e.g. file integrity verifications), to consume less storage space.
i don't know ...
11
votes
1answer
226 views
“Please Enter Nth Character” without HSM
This question has been asked a few times, but always in the format
"How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?"
And the ...
0
votes
4answers
83 views
7
votes
3answers
322 views
Is Using MD5 Sufficient Reason to Reject This Payment Processor?
I'm evaluating a credit card processor[1], and I noticed they are using MD5 as part of a salted hash algorithm to protect a secret key. Since I know MD5 is generally considered broken, this feels like ...
5
votes
3answers
2k views
With ASIC bitcoin miners, should SHA256 be considered insecure for password hashing?
I'm sure everyone here has seen the rise and further rise of bitcoin. The process used for mining bitcoin is basically "let's brute force an SHA256 hash that is less than this amount"
That being ...
0
votes
1answer
80 views
what does GUID have that a whirlpool, md5 or sha2 hash dont
I'm trying to understand the use of GUID and what has always left me wondering is what's so special about them that I should consider using them instead of rolling my own type of unique id.
In other ...
2
votes
1answer
89 views
Securely store two values per user in SQL
I have come across the need in my web app to store two values for each user. These values would need to be retrievable from a value stored in a URL. I would prefer to store neither of the values in ...
24
votes
5answers
1k views
How does hashing work?
I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it ...
11
votes
4answers
469 views
Handling passwords in a web application
I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
6
votes
1answer
105 views
Encrypting short identifiers?
I am developing a webapp that does not reveal record count, because it hides the primary key. I am looking for a better way to do this.
My favorite idea is to encrypt the ID itself with a block ...
3
votes
5answers
145 views
Expanding/Inverse Hash function
First off, before I ask my question, let me explain what I am NOT asking. I am NOT asking for a way/method to reverse a hash output; by definition, a hashing function is one-way.
Is there such a ...
8
votes
2answers
81 views
PINsentry PRNG and Bank Cards
My bank provides me with a device similar to this:
The device is essentially a PRNG, presumably based on the date/time of it's internal clock, synchronized with the bank servers.
To generate a pin ...
1
vote
1answer
210 views
Use brute force to mitigate brute force
Just an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information.
My idea is this...
When storing a password in ...
21
votes
8answers
1k views
Why improvising your own Hash function out of existing hash functions is so bad
I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes.
After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
18
votes
4answers
1k views
When hashing passwords, is it ok to use the hashed password as the salt?
I don't like this idea. But I can not come up with a technical argument against it. Can somebody explain it to me? The basic idea is:
$passwd = 'foo';
$salt = hash($passwd);
$finalHash = hash($passwd ...
5
votes
2answers
113 views
NTLMv2 resistance to bruteforcing
I have a question regarding NTLMv2 resistance to password bruteforcing.
I know that some modern graphic processors (like Radeon 6990) are able to calculate billions hashes per second and crack NTLM ...
