A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

3
votes
2answers
513 views

How a hacker knows how many times a password was hashed?

So, I've been reading a lot of questions about security and hash functions on this site and others. I am no expert, just a curious mind and in my understanding the more iterations used to hash a ...
1
vote
2answers
56 views

What the most trustworthy way to demonstrate digital File Integrity?

I'm looking for ensure the integrity of uploaded files and demonstrate this integrity to a user. In my current scenario, a user sends multiple files in several different formats, these files are ...
0
votes
0answers
53 views

PHP crypted or hashed string to decode

I have a problem for captcha solve in 3 days. This is crypted or hashed captcha cookie 55debbcf069c81440660431 23 characters long. I found last 10 character is 1440660431 timestamp. I think first 13 ...
3
votes
1answer
61 views

Can I safely and securely store hash(sessionId) in application logs?

I'm considering storing a hash of a user's session ID in our applications logs on each request. This would allow users sessions to be easily tracked back to actions in our logs. I understand that ...
0
votes
1answer
29 views

Is there any problem using empty salts with PBDKF for this purpose?

The aim is to generate a secure key for symmetric encryption. I have a master password, from which I want to generate the key for symmetric encryption, in order to encrypt other passwords. The idea ...
3
votes
2answers
630 views

Determine salt length from hash

I am writing a basic Unix password cracker in Python that would work for MD5, SHA-1 and SHA512. I know that the salt in MD5 correspond to the 2 first chars of the encrypted password, and thus I ...
1
vote
1answer
62 views

Hashing passwords in OpenLDAP

I've seen a few posts on the internet saying most people store user passwords in OpenLDAP using one of OpenLDAP's many, built-in hashing functions. But OpenLDAP itself recommends handing off password ...
7
votes
2answers
121 views

Secure way to shorten a hash

If I want to save a hash of a certain number of bits, but my hashing algorithm gives me more bits than I need, then what is the safest way to shorten it? Should I: Just remove the first or last ...
0
votes
0answers
27 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
1
vote
0answers
158 views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
-4
votes
1answer
40 views

How to find an encryption algorithm between two hexadecimal numbers? [closed]

I have several numbers that are generated by a server. They are 16 digits long and are hexadecimal. I have no idea whether or not any salting or hashing techniques were used. Can I find the encryption ...
1
vote
3answers
44 views

Hashing Algorithms Costs vs Sleep

I understand most of the concepts behind hashing password but this one still escapes me. I understand that you want the hash to take some time ( a couple milliseconds) so the attacker can't ...
26
votes
5answers
4k views

Doesn't hashing passwords server side mean a compromised website could leave passwords vulnerable?

So the traffic is encrypted to a website so the password is safe during transmission and also if the website is hacked then the database only contains hashes. But couldn't the hacker create a server ...
4
votes
1answer
63 views

“MAC function must resist existential forgery under chosen-plaintext attacks”, what does that mean?

While reading about MAC (Message Authentication Code) I have faced this sentence: MAC function must resist existential forgery under chosen-plaintext attacks but I got confused. What does ...
1
vote
2answers
109 views

Double hashing using a relatively new hash and a old, tested one

Note: I am relatively new to cryptography in general, so please point out if I make any misconception here. I heard that you should always use well known crypto/hash functions, that have already been ...
-3
votes
2answers
64 views

When should a password be hashed? [duplicate]

I develop a Smartphone App and have a little question: When should I hash the user passwords, on the device or upload them in plain text and hash them on the server before stored in the database?
5
votes
1answer
155 views

How to store/encrypt fingerprint?

Storing password is a no brainer : use a password hasher. But.. How do you proceed to store fingerprints securely on your server? Meaning that even if your server and all it's data is stolen, someone ...
2
votes
4answers
92 views

Is there a security advantage towards hashing a password on the server? [duplicate]

I'm working on an authentification system. Now in this system the user logs in and sends a hashed password to the server. Is this enough or do I have to rehash the password again? So basically is ...
-1
votes
1answer
150 views

Does SHA-512 become suitable to store a password if we use salting and iteration with it?

Today I have read this discussion about SHA-256 and SHA-512 and that we should not use any of them to store a password securely. And I have read here that instead we can use the PBKDF2 hashing ...
1
vote
2answers
490 views

which hashing algorithm is better to use to store a password, sha256 or sha512? [duplicate]

which hashing algorithm is better to use to store a password, sha256 or sha512? I know that sha512 is more secure than sha256 but I was wondering if it has some disadvantages or it is completely ...
0
votes
2answers
69 views

Several hashing routines support client side work. Doesn't the hash just become a password equivalent?

Isnt Secure Remote Password Protocol (SRP) pretty much client side hashing? Argon2 the winner of the PHC also allows for client side hashing. How do these systems avoid the plaintext equivalence ...
-1
votes
0answers
74 views

Best way to keep encrypted data, which is often decrypted?

I'm starting project for my BSc, where I want to send e-mails with keys (e.g. games on Steam platform, Paysafecard) on Allegro, which is similar to eBay. I will have my own database with users' data ...
2
votes
1answer
105 views

Reverse engineering of a global hash salt from known plaintext and hash

First of all i'm not asking what is a hash, or something else. I will try to explain what i'm searching clearly: Let's say I have a dump of a database, all the passwords of this database are hashed, ...
0
votes
2answers
70 views

which hash algorithm takes longer time if we compare between md5 or sha256?

Which hash algorithm takes longer time to compute if we compare between md5 and sha256? I do not want to use it for security reasons so I do not care about which one is more secure, I just want to ...
-4
votes
1answer
68 views

How to identify this hash?

I have one hash, I know its value, but not its type. Here is it: 6dfb036bf703d75f9bc8219ba1224d876783fa61 I tried something like php -r "echo sha1('abc');", but it gave me another value, so this ...
1
vote
1answer
81 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
1
vote
1answer
51 views

What is the difference between Key Derivation Function and (salted) Hash?

I see in this post that the main difference is that KDF outputs have "certain randomness properties", and I don't understand what does it mean. Suposing that that "certain randomness properties" are ...
2
votes
3answers
138 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
9
votes
2answers
139 views

Can client-side hashing improve after-the-fact security in response to password leaks?

Several questions on this site address client-side password hashing, and none of them admit to any security benefit beyond protecting other sites the user might use the same password for. However, ...
1
vote
0answers
64 views

John The Ripper and OpenCL on AMD FirePro

Trying to work with John 1.8.0 Jumbo 1 I noticed that OpenCL won't work for me. I used autoconfig (meaning configure and build with the option to enable OpenMPI) in order to build JTR for my Mac Pro. ...
3
votes
1answer
87 views

What's the weakness of keyed-MD5 for message authentication?

I've seen public web API's using keyed-MD5 to generate message authentication code rather than adopting the HMAC algorithm. People wouldn't just invent HMAC for fun, so it must have some advantages ...
4
votes
1answer
148 views

Sending Encrypted Messages with Hybrid RSA, AES and HMAC SHA-256

Is this a Secure strategy for sending a large Encrypted Message using Hybrid RSA 2048, AES 256 and authenticated with HMAC SHA-256: Given the Alice already has Bob's RSA Public Key, Alice: ...
2
votes
1answer
130 views

if a public key cannot decrypt the cipher text, then how can a private key?

I understand the "public" part of public key cryptography. Not the "private" part. For example, let's say our public key is %7 (modulo 7). And the message to be encrypted is 22. And we know that 22 ...
5
votes
5answers
2k views

Salted password + hash - is it really useful? [duplicate]

I am new to the topic and wanted to know the concept of having salted hashes before going down to the technical details. From what I have understand password - plaintext hash password - plaintext ...
1
vote
2answers
136 views

What if the Local Windows Cert Store is Compromised?

The diagram below illustrates chaining digital certificates up to a publicly trusted Root Certificate: I have been researching how trusted root authorities (such as GlobalSign or Verisign) are used ...
4
votes
0answers
79 views

Sqlmap trimming output

I've decided to learn Sql/map but having an issue with Sqlmap trimming some of my output, the hash. The hash is about to be 32 characters long but I'm only getting 25 and the warning: [WARNING] ...
19
votes
7answers
4k views

Why not mix hashes?

To make hashes harder to target by specialized hardware, I intuitively imagine that mixing a set of different hash algorithms should provide additional strength. For simplicity lets assume Hash1 is a ...
3
votes
1answer
119 views

How does hashcat figure out the SHA CRYPT ROUNDS on a Linux password

A part of my /etc/login.defs file looks like this: ENCRYPT_METHOD SHA512 # Define the number of SHA rounds. # If not specified, the libc will choose the default number of rounds (5000). # The values ...
8
votes
2answers
401 views

*NIX shadow file password format

I'm trying to get shell access to a router and have managed to retrieve its /etc/shadow file: root:$1$$N76hdwGfg11g0KdKbtyh21:0:0:root:/root:/bin/bash I've tried to use john to crack it but ...
5
votes
2answers
61 views

Understanding digitial certifications

q1) Does that mean that every time information is exchanged, both the original data + digital certification is sent? Meaning data + signature for each and every exchange. q2) Can any kind soul here ...
-3
votes
1answer
102 views

What type of hash is this MD4(MD4(($pass)).(strtolower($username))) [closed]

Can I decrypt this hash? Domain Cached Credentials: MD4(MD4(($pass)).(strtolower($username)))
4
votes
2answers
67 views

Determining strength of truncated HMAC

I have data stored on a device which I must guarantee integrity, for ease of explanation the data is like numerical field representing 'credit balance available'. The device only ever interacts with ...
9
votes
1answer
95 views

Is Rfc2898DeriveBytes using HMAC SHA1 still considered “secure enough” for hashing passwords?

I've been told by a CISSP that the .NET class Rfc2898DeriveBytes would not pass a security audit today because it still uses SHA1. It's reliance on SHA1 - even with the iterations - leaves it too ...
1
vote
1answer
37 views

Reproduce part of a hash

I know very little about hashes, but I was wondering if I know the first 20 digits of what got hashed and the first 8 digits of the hash, is there any way to figure out the entire hash? For example: ...
2
votes
1answer
59 views

Is it secure to use pbkdf2 for both password hashing and key generation

I'm writing a password manager, right now for each individual site, I already used master password + random salt with PBKDF2 to generate encryption key to encrypt its password (each site has its own ...
3
votes
1answer
64 views

Distributed tokenization for credit card numbers

I have two locations within the same firm that hold credit card numbers. I want to be able to "join" on credit card number to do business analytics after transmitting card number-linked data from one ...
2
votes
1answer
100 views

Is it insecure to provide a hash of an AES password?

I have made some software that encrypts and decrypts files using AES. I was wondering if it is safe to write a hash of the password to the file so that the program can check if a password is correct. ...
0
votes
1answer
53 views

Can you resalt hash/rainbow tables after finding the salt for something?

After a rainbow/hash table is salted, is it possible to resalt it after finding the correct salt instead of generating it all over again? If not, what is preventing you from doing so? How can you find ...
1
vote
1answer
185 views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? Where would one get said tables or can they be ...
2
votes
1answer
113 views

What is the difference between a hash table and a rainbow table, and how are they both used?

Is there much of a difference between the two tables? Can you get one from the other? (i.e. hash -> rainbow) How do they work? Are there different variables (in reference to speed, strength, ...