A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

2
votes
0answers
34 views

Why one must use encryption, and not a cryptographic hash, to store biometric information? [duplicate]

Why one must use encryption, and not a cryptographic hash, to store biometric information? I am not sure why encryption must be used to store biometric information.
4
votes
2answers
114 views

Location of Password Hashes on a Windows Local Machine?

"Where are the two locations that user's password hashes are stored on a local windows machine?" My place of business asked me this question. I know that the SAM stores password hashes, where would ...
-7
votes
2answers
102 views

What is is the best way to create virus signature database? [on hold]

We are thinking to develop a new Antivirus program. The main concern is to create a virus signature database. I want to ask what is the best possible way to add viruses signature in our database to ...
1
vote
0answers
30 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
8
votes
2answers
98 views

Is there a threshold of bits of entropy below which hashing becomes meaningless?

I just read a help page by a mail provider in which they state that all mobile phone numbers will be stored as a salted hash. This strikes me as interesting, since phone numbers don't contain a lot ...
2
votes
3answers
62 views

Verify password hashed with nonce when the password is already hashed on the server?

I found this picture in the Wikipedia nonce article: To avoid sending the password in clear text and prevent replay attacks, the password is hashed together with one random number from the server ...
1
vote
3answers
140 views

why not use hashed password as password [duplicate]

Why dont we use our mobile phone tho hash a password and then enter the hash on a website as the password ? This way the password for the website would be much more complex. Would this even increase ...
-5
votes
3answers
74 views

how to know the way in which password was encrypted [closed]

i have a encrypted password basically hashed i don't know what it is some thing like 11dfb34b27f539a5e785b68e529fd470 and i know the password i.e., the plain text but i want to know the way that how ...
1
vote
2answers
69 views

Isn't oAuth weaker than traditional passwords

I understand the need for oauth for programmatic access to apis, etc. whereas passwords are used for more human-level authentication. However when we store passwords, we (hopefully) salt + hash them. ...
0
votes
2answers
52 views

PGP vs Hash functions

What is the difference (in terms of security strength) between checking a package' integrity using pgp and hashing functions (i.e. sha256)? Isn't pgp less secure as the verifier must trust the ...
-2
votes
1answer
51 views

What reasons for implementing reversibly encrypted data are there? [closed]

Excuse me if I am wrong, as I am very new to the field, but it seems that the only reason one should encrypt something in a reversible way is if the object receiving the encrypted data is a person. ...
0
votes
2answers
84 views

Using a hash to encrypt data

Lately, I've been reading about cryptography and thought of a method of using hashes to encrypt data. From what I know, hashes are unique to each object and are one way functions. Encryption on the ...
1
vote
1answer
45 views

Re-sign Certificate Using Different Hashing Algorithm

Consider a certificate used by a Certification Authority. This is currently hashed using SHA-1. I'd like to keep the same public/private key for this, but hash it using SHA-256. By hash it I mean hash ...
1
vote
3answers
42 views

Why are there Hashes next to downloads? [duplicate]

I've seen several sites wehre they would put the hash of the downloadable file next to the file. Why do they do this ? I understand the purpose of comparing the hash of your file with the online hash ...
6
votes
1answer
266 views

Who in UK I can report to if I know company is storing my password in plain text?

I live in UK, some time ago I wanted to login to my electric company account to check the bill and such, and I had forgotten my password - long story short I got my account locked and had to call ...
3
votes
2answers
91 views

Are there any known MD5 hash collisions of messages of different length?

All the examples of MD5 hash collisions I've come across comprise two different messages (inputs) of the same length. The first and second messages have different values for a number of bits and the ...
26
votes
10answers
5k views

Could I recover the content of file from its checksum/hash?

Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file. Now assume ...
-2
votes
0answers
47 views

Retrieve original password from hashed password (without salt)

Assume the victim is a who did not use salt to hash the stored passwords. Somehow let's say I steal some passwords from the database. As an attacker, is it a good a approach to create a dictionary ...
0
votes
1answer
88 views

How to brute-force WPA-2 password of specific set of characters using oclHashcat?

I want to test oclHashcat on a WPA-2 PSK password of length 8 containing only characters in the set {a-z, A-Z, 0-9}. To do this I have already captured the handshake in a .cap file and converted it ...
1
vote
3answers
124 views

Hash algorithm that provides less than 10 bytes

I know it's insecure, but I need to for number of profile; I need a hash algorithm to provide less than 10 bytes.
0
votes
0answers
11 views

Applocker rules Publisher vs hash

I'm interested in deploying application white-listing for a large scale environment by using the Windows Server built-in AppLocker mechanism. There is no Internet connection to the environment. My ...
-4
votes
1answer
88 views

insecure hash functions

Good hash function should be collision resistant. In 2004 it was shown that MD5 is not collision resistant. As such, MD5 is not suitable for applications like SSL certificates or digital signatures ...
1
vote
2answers
73 views

What is the real advantage of using a “more secure” algorithm like bcrypt for password hashing?

I read this article about password hashing using bcrypt as the recommended method. The advice is similar to what they're saying on hacker news about not using something like SHA2+salt. There are other ...
0
votes
0answers
37 views

Hash function for credit card [duplicate]

Hey PCI and hash expert, What hash function is good for hashing credit card and providing collision resistance? Some context: We are building a tokenization service, so each credit card will have ...
0
votes
1answer
33 views

Unique human view count system without captcha on Pay Per click system, using cryptographic proof of work

I have a system that will be paying users per unique view on a page. I need to prevent 80% of fraudulent automated traffic from being counted. I need to avoid captcha.I would like to implement a ...
1
vote
0answers
45 views

SHA1 and SHA256 initial digest to start from

Let's say I have: C = A + B where A and B contain strings and the plus sign means concatenation. I already hashed A with SHA1 and SHA256 and got a digests. I forget what the original A string was, but ...
1
vote
1answer
32 views

PHP BLENC extension security concern

PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
2
votes
2answers
79 views

What does it mean to have authentication without confidentiality or authentication without encryption?

I came across these functions m+EeA(H(m)) (for authentication without confidentiality) and m+H(m+k) (for authentication without encryption) and I'm having a bit of a difficult time understanding them. ...
-1
votes
1answer
26 views

Format of hashed strings [closed]

When hashing a string, sometimes I see the format like so: {SHA512}1G2zjh2Bso/LzS06JDLXcELCJX4TQm7oXL5Et3Yg4Veyji7iQW26VnBdEHiURM5evO6duJjzY5387mkWV0oiyYA= Specifically the section indicating the ...
5
votes
2answers
93 views

When can you not use strcmp?

I've read that one shouldn't use strncmp(userSuppliedPassword,origPassword,sizeOfArray) (or String.equals in Java) since one can use a timing attack to guess the password. Rather, one should use a ...
1
vote
1answer
78 views

Protecting email addresses if their hashes are publicly avaliable

I am working on a project, where user email address hashes will be available publicly, and I need to prevent them from being quickly discovered by spammers. The main idea of the undertaking is to ...
3
votes
2answers
54 views

Use password to calculate checksum for API requests

I was wondering if it would be an effective way of securing an API by requiring all requests to be checksummed, salted with the users password (or a hashed version)? With securing I mean making it ...
1
vote
3answers
82 views

Parameters for PBKDF2 for password hashing

I use PBKDF2 with SHA-256 to store hashes of passwords. I use the following parameters: number of iterations desired = 1024 length of the salt in bytes = 16 length of the derived key ...
0
votes
1answer
27 views

First string in hash collisions bucket

My understanding of hashing is conceptual at best and I'm assuming things that I'm not sure of and it leads me to a question that I don't even know if it's founded or not. So please correct my ...
5
votes
1answer
88 views

Random string vs hash(random string)?

I'm implementing a one-time token service. Each of these one-time token represents some server side data/action associated with it (a 'email confirm' action for example), so that my web service can ...
-1
votes
1answer
43 views

Is there any kind of encryption that returns constant number of characters?

I wonder if there is any kind of publicly known encryption (not hashing) algorithm that generates constant number of characters independent of the input. I have came across an online platform that ...
3
votes
2answers
56 views

Sign a callback URL

I have a Single Sign-On system that works this way : User clicks link on clientsite.com that redirect him to mastersite.com?returnTo=http://clientsite.com If auth is valid, the user is redirected ...
3
votes
1answer
78 views

John the ripper is not identifying hashes

I'm attempting to use JTR against a password protected zip. I have created the hash file using:zip2john filename.zip > filename.hash and i get a successful output:file.txt is using AES encryption, ...
17
votes
4answers
2k views

Why would a website serve different versions of a file over HTTP and HTTPS?

Here is a link given on curl's official website: (prefix omitted) bintray.com/artifact/download/vszakats/generic/curl-7.46.0-win64-mingw.7z When I downloaded it with prefixes http:// and https:// I ...
5
votes
1answer
594 views

Is it bad to add a guessable password to a random password?

Let's say a person has a password they used before they knew about how to make good passwords, like peter123. Let's also say that when they were thinking of a better password, they found they could ...
1
vote
0answers
41 views

trapdoor information with hash functions

I have been playing with an idea for the past few days. I have been unable to find information on here or crypto.stackexchange about using trapdoor information in the input to a hash function. ...
4
votes
1answer
61 views

Unable to get correct base for cracking Crypt3 SHA-512 on Linux with Python

I am reading a book and it gives me a simple Python script to crack /etc/shadow passwords that were encrypted with the crypt() function. It then challenges you to amend the Python program to work with ...
0
votes
1answer
63 views

hashcat hash type, convert sha256 binary to hex

I am attempting to use hashcat to crack a hash that is 32 characters in length. I know the hash is sha256. When i run the following command hashcat -m 1400 binary-hashfound.txt ...
6
votes
2answers
113 views

If no maximum length is placed on a password, can't collisions occur?

As I was thinking about storing password hashes in a database, it dawned on me that there might be hash collisions if there is no set maximum length for the password being hashed. My understanding is ...
50
votes
13answers
6k views

Sequential identifying string that can't be reverse engineered (the “invoice number” problem)

Let's say I operate a website where you can create cat pictures. I give every cat picture a unique identifier so that it can be shared on social media with http://catpictures.com/base62Identifier. I ...
1
vote
1answer
24 views

One Input Two Hashes

Suppose I have some password x, and two different hash functions h1 and h2. I can then compute the hash y1 = h1(x) and y2 = h2(x). Is there any sort of vulnerability in this case? More ...
-1
votes
2answers
56 views

How secure is a hash + reverse(hash)?

From what I know there is a method called salt added to hashes in order to prevent attackers from using pre-computed hashes. As long as the attacker can find a static salt in reverse hashing and do a ...
8
votes
3answers
814 views

Downloaded file checksums

More than often next to the download button of a file there is a variety of checksums. When I download a file what security risks am I exposed to if I don't check for its integrity?
20
votes
6answers
4k views

Can any password hash ever be secure?

My understanding is the the main reason MD5 is insecure, is that it can be calculated too quickly, allowing too many attempts to be tried. People recommend instead using a hash that has been designed ...
3
votes
2answers
181 views

Hashing password multiple times with different random salts

I have read a lot of answers about this topic like: https://programmers.stackexchange.com/questions/115406/is-it-more-secure-to-hash-a-password-multiple-times. ...