A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

1
vote
0answers
31 views

Is it secure to use pbkdf2 for both password hashing and key generation

I'm writing a password manager, right now for each individual site, I already used master password + random salt with PBKDF2 to generate encryption key to encrypt its password (each site has its own ...
2
votes
0answers
34 views

Distributed tokenization for credit card numbers

I have two locations within the same firm that hold credit card numbers. I want to be able to "join" on credit card number to do business analytics after transmitting card number-linked data from one ...
2
votes
1answer
83 views

Is it insecure to provide a hash of an AES password?

I have made some software that encrypts and decrypts files using AES. I was wondering if it is safe to write a hash of the password to the file so that the program can check if a password is correct. ...
0
votes
1answer
39 views

Can you resalt hash/rainbow tables after finding the salt for something?

After a rainbow/hash table is salted, is it possible to resalt it after finding the correct salt instead of generating it all over again? If not, what is preventing you from doing so? How can you find ...
0
votes
1answer
52 views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? Where would one get said tables or can they be ...
2
votes
1answer
90 views

What is the difference between a hash table and a rainbow table, and how are they both used?

Is there much of a difference between the two tables? Can you get one from the other? (i.e. hash -> rainbow) How do they work? Are there different variables (in reference to speed, strength, ...
0
votes
1answer
47 views

Is this a secure hash “Function” for integrity?

I was wondering what were the posible security (not efficieny) issues with this hash "function": Although not an actual function, this method turns a message of any length into a message of fixed ...
3
votes
1answer
56 views

Secure text document's fingerprint

The purpose is the same as with hashing: given set of confidential documents, I want to process them and store something secure like salted hashes/bcrypt. Later, when new document is given, I want to ...
5
votes
1answer
129 views

Is Django's approach to password reset tokens secure?

I am implementing a password reset feature for a web application and am contemplating adopting an implementation similar to Django. In a nutshell, Django creates a token who is comprised of a ...
2
votes
1answer
94 views

How much does knowing the zxcvbn password strength help an attacker?

On an answer to the question How critical is it to keep your password length secret?, Mike Ounsworth commented that by storing the zxcvbn-calculated entropy of a password you make it easier for an ...
2
votes
1answer
70 views

Save Password length after hash to minimize calculation

Reading this topic How critical is it to keep your password length secret? following scenario comes to my mind: Assume I've a web application (PHP written using password_hash()) using salted password ...
3
votes
2answers
108 views

Cryptographic algorithm to anonymise strings in pronounceable fashion?

NB: I originally posted this on SO (link), but then realise Security SE be more suitable, since there's existing questions around Crypto-PAn, which is similar here I have a logfile of database ...
7
votes
3answers
2k views

How are leaked government credentials possible and what's the point?

In the wake of all these leaked/stolen/hacked government login/passwords being stolen it got me thinking. How is the leaking of these passwords even possible? Or are they of any real use? Aren't all ...
-2
votes
2answers
118 views

What are hashes that begin with $1$…? [closed]

I've found this hash and I'm wondering what is it. $1$h6k3X5db$pp8WQ5R5YYL5bNyQj2wP70
1
vote
1answer
55 views

Using username as salt safe enough? [duplicate]

Instead of creating a separate salt generator for each user, can't I just use their username as a salt? It would be unique for everyone, and achieves the purpose of the salts. <?php ...
31
votes
6answers
3k views

Does verifying identity by positions in passwords mean passwords are stored unhashed? [duplicate]

If authentication occurs by asking the user for the characters at certain positions in the password (such as: give the 3rd and 7th character in the password), does this imply that passwords are stored ...
0
votes
2answers
121 views

Weird 8-character hash [closed]

I'm investigating an application. In a XML file I came across: <ScrambledPassword>U8P3J2N1</ScrambledPassword> I ran it through a hash identification script which is telling me it's a ...
1
vote
3answers
81 views

How to identify hashes [closed]

How can I indentify a hash? Not with length only, I mean: as I know, specific hashes has specific charsets. Where can I find them? I need this information for making a hash indentification tool. (this ...
0
votes
0answers
57 views

Line Length Exception in hashcat

I'm very new to cracking a password so sorry if I sound stupid. I am trying to get my admin password from my second PC (I lost it). I did find the SAM file with kali linux and with bkhive and samdump ...
2
votes
1answer
29 views

Personal cipher/digest preferences ignored when generating a new key pair in GnuPG

I have specified personal digest preferences in my ~/.gnupg/gpg.conf: personal-digest-preferences SHA512 SHA256 SHA384 SHA224 SHA1 then, I have generated a new key pair. But when I check the ...
0
votes
2answers
51 views

Is there a way to give out secure tickets wihout storing them?

I'm building a website on which I want to make it very easy for users to create pages anonymously and later be able to come back and edit those pages. One way to do so is to give out confidential ...
3
votes
2answers
926 views

big O for finding hash of length n O(2^n) or O(2^(n-1))?

note The wikipedia article does not use the big O notation correctly. Thus O(2n) just means 2n attempts I read on wikipedia (CGA) that finding a collision preimage for a cryptographich hash of ...
1
vote
3answers
67 views

Potential collision with hash password

Normally, the password size is fixed by the hash function in which the password is given right ? Because otherwise, if the password size is bigger than the hash result size, there should be potential ...
0
votes
1answer
14 views

Is the method of hardening the creation of a Cryptographically Generated Address (CGA) called hash extension

CGAs are sha1 hashes truncated to a 59 bit value. Along with a 3 bit security parameter they form a IPv6 address (more precisely the interface identifier). from wikipedia: The Sec parameter ...
5
votes
5answers
851 views

How secure is it to keep the salt with the password hash? [duplicate]

In Linux we have the salt just next to the password hash in the /etc/shadows file. I always hear that salt value prevents hashed passwords from being cracked by brute force methods. But if somehow we ...
2
votes
3answers
216 views

How can two parties compare whether a simple (5 letter) shared word matches, without disclosing their word to each other?

I'm having some trouble with this scenario, some advice would be great. The context is that a group of people have each been give a simple 5 letter word - for example: Alice: ACTOR Bob: JEANS Dan: ...
0
votes
1answer
30 views

Virtual Machine Integrity Hash Check

If I used virtualbox to create a snapshot template of a preconfigured linux machine and wanted to ensure that no one has tampered with my snapshot, could I simply keep a comparable hash of the VDI ...
1
vote
4answers
249 views

Why is a password accompanied by a username deemed 'safer'?

While browsing this community I notice that some people say that the main advantage of usernames accompanied by passwords is as they take more tries to be brute forced, however I don't think that is ...
1
vote
1answer
50 views

How to change personal cipher/digest preferences of existing OpenPGP key in GnuPG?

The OpenPGP key contains a list of personal algorithm preferences (the meaning of the numbers can be decoded in RFC 4880): # gpg -a --export "foo@example.com" | gpg --list-packets | fgrep 'pref-' ...
0
votes
2answers
87 views

Is there a cryptographic function that generates a reconizable visual pattern?

I have to build a system that will ultimately print a pass allowing access to a building. The validation of this ticket will be done manually (it can also be automatic but that's not likely at this ...
19
votes
3answers
2k views

How to replace an old password hashing method with a newer one in software? [duplicate]

The software that our company builds just went through a security audit. The auditors flagged our use of MD5 for hashing passwords that users can set if they want a password on their files. Having ...
0
votes
2answers
58 views

Getting the DNS root name servers in a secure way

It doesn't happen often that a root name server changes, but when it does sometimes it takes months for OS vendors to provide patches and in the mean time there is a security risk. So: How to get ...
11
votes
5answers
2k views

Is this way of encoding cryptographic hashes safe?

I'm looking at the code of a particular web application that handle file uploads. For some reason, instead of using the cryptographic hash function (SHA-256 in this case), they derive an ID from it, ...
1
vote
1answer
121 views

Is This DIY Password Authentication Scheme Acceptable?

This is mostly a thought experiment for client/server communication, and I want to know the flaws. When a user account is created (with U as the username and P as the password,) I generate a random ...
9
votes
3answers
850 views

How secure are sha256 + salt hashes for password storage [duplicate]

I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
1
vote
1answer
65 views

Is it worth it to implement both SHA2 and SHA3 at the same time?

I'm creating a password storage system for a web server I'm building for fun. Would it be more secure for me to use both SHA2 and SHA3 for hashing, and then store them in a database? If I use both ...
0
votes
1answer
52 views

Can XOR be used in a Merkle Tree instead of concatenation?

I am trying to understand why, in a Merkle Tree, the concatanation between hashes is used - and not for example the XOR operation. Can they be considered the same for the purpose of a Merkle tree? I ...
0
votes
0answers
46 views

What is the format of PDF hash?

When I use a tool like pdf2john.py from John The Ripper on an encrypted PDF, it gives me an output like: ...
-2
votes
1answer
60 views

What hash algorithm is Disqus using now for users' emails? [closed]

Disqus previously used the MD5 algorithm to hash users' emails. A group of Swedes used a dictionary attack to reveal the email addresses (and in many cases identities) of hundreds of Disqus users, ...
2
votes
0answers
29 views

CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
0
votes
0answers
45 views

Designing a security system for road pricing

It's my first semester with Information Security and I still feel a little lost. Sorry in advance for stupid mistakes I may have made. the examples in round brackets below are my own ideas, wrote ...
5
votes
6answers
201 views

Is hashing a string a secure manner for generating passwords?

I have several servers that I'm using for an online business. I have passwords for MySQL, Wordpress, SSH, FTP, Domain Provider, Paypal, and many more. I wanted to have a different, very long password ...
5
votes
3answers
433 views

Any reason not to encrypt a 32 byte value by XORing it with a PBKDF2 hash?

Ordinarily I'd use PBKDF2 to generate a key which i'd use with AES. But seeing as the hash is going to be as long as the data I need to encrypt is there any disadvantage to just XOR'ing it? My ...
1
vote
3answers
57 views

What type of hashing method is used for the private key to encrypt for signing messages?

To use RSA for signing, Alice takes a hash of the message, encrypts the hash using her own private key, and appends the result (this is the signature) to the message. Eve can of course still ...
0
votes
2answers
114 views

Would my protocol be safe?

Suppose I have a protocol like the one below between users A and B; -A sends random nonce G1 to B -B sends back hash_k(G1) and random none G2 -A verifies hash_k(G1), then sends back hash_k(G1 | ...
4
votes
3answers
145 views

Secure Hash of a very short payload - is it possible?

I am looking to verify the integrity of a very small payload, approx 64 bytes, which will be stored in a QR code. I need to verify that the payload has not been generated or altered by an attacker. ...
0
votes
0answers
37 views

Understanding the application of hashes, HMACs, and KDFs

I think that I understand the right application cases for the following crypto functions, but I'd like to confirm my understanding and also propagate the safe use of crypto throughout the intertubes. ...
2
votes
1answer
100 views

Is there a benefit of using stateless JWT over SHA256 hash for API tokens?

Does it make sense to use stateless JWT (without persistent storage) over plain SHA256? Example scenario: User logs in User token generated as follows: a. JWT.encode(userId, 'secret') or b. ...
1
vote
2answers
106 views

Is it possible to crack hash with known salt? If yes how?

Hello folks, I was wondering , if the salt in the hash is known to us,then is it possible to crack to extract the password from the hash? If Yes, How?
2
votes
3answers
129 views

Can I initially hash passwords with SHA instead of hashing them with bcrypt to decouple requests from slow crypto functions?

I'm using bcrypt for some web service requests that hash multiple passwords. The problem is that these web service requests can take minutes to complete due to bcrypt. Not very user friendly. My ...