A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

3
votes
1answer
45 views

Secure text document's fingerprint

The purpose is the same as with hashing: given set of confidential documents, I want to process them and store something secure like salted hashes/bcrypt. Later, when new document is given, I want to ...
-2
votes
2answers
51 views

What is to hash a password? [duplicate]

Sorry if it's not the right place, but I can't find a translation(to spanish). Can someone explain it in another words?
5
votes
1answer
87 views

Is Django's approach to password reset tokens secure?

I am implementing a password reset feature for a web application and am contemplating adopting an implementation similar to Django. In a nutshell, Django creates a token who is comprised of a ...
0
votes
0answers
55 views

How much does knowing the zxcvbn password strength help an attacker?

On an answer to the question How critical is it to keep your password length secret?, Mike Ounsworth commented that by storing the zxcvbn-calculated entropy of a password you make it easier for an ...
2
votes
1answer
65 views

Save Password length after hash to minimize calculation

Reading this topic How critical is it to keep your password length secret? following scenario comes to my mind: Assume I've a web application (PHP written using password_hash()) using salted password ...
3
votes
2answers
82 views

Cryptographic algorithm to anonymise strings in pronounceable fashion?

NB: I originally posted this on SO (link), but then realise Security SE be more suitable, since there's existing questions around Crypto-PAn, which is similar here I have a logfile of database ...
5
votes
3answers
2k views

How are leaked government credentials possible and what's the point?

In the wake of all these leaked/stolen/hacked government login/passwords being stolen it got me thinking. How is the leaking of these passwords even possible? Or are they of any real use? Aren't all ...
-4
votes
1answer
97 views

What encryption is used in this email? [closed]

bobnick1998sw@yopmail.com 96Xx7Tfrf+2zLvKiSXLAoY+W4dh6h+r4ML3JlmXrkyQ= bobnick1998sw1@gmail.com 888IK6Jz5tLP11RcEfWB/CcSbq4x7FIX2BtRi15o7dc= Here are the emails and the encrypted emails, now can ...
-2
votes
2answers
116 views

What are hashes that begin with $1$…? [closed]

I've found this hash and I'm wondering what is it. $1$h6k3X5db$pp8WQ5R5YYL5bNyQj2wP70
1
vote
1answer
54 views

Using username as salt safe enough? [duplicate]

Instead of creating a separate salt generator for each user, can't I just use their username as a salt? It would be unique for everyone, and achieves the purpose of the salts. <?php ...
31
votes
6answers
3k views

Does verifying identity by positions in passwords mean passwords are stored unhashed? [duplicate]

If authentication occurs by asking the user for the characters at certain positions in the password (such as: give the 3rd and 7th character in the password), does this imply that passwords are stored ...
0
votes
2answers
119 views

Weird 8-character hash [closed]

I'm investigating an application. In a XML file I came across: <ScrambledPassword>U8P3J2N1</ScrambledPassword> I ran it through a hash identification script which is telling me it's a ...
1
vote
3answers
80 views

How to identify hashes [closed]

How can I indentify a hash? Not with length only, I mean: as I know, specific hashes has specific charsets. Where can I find them? I need this information for making a hash indentification tool. (this ...
0
votes
0answers
51 views

Line Length Exception in hashcat

I'm very new to cracking a password so sorry if I sound stupid. I am trying to get my admin password from my second PC (I lost it). I did find the SAM file with kali linux and with bkhive and samdump ...
2
votes
1answer
26 views

Personal cipher/digest preferences ignored when generating a new key pair in GnuPG

I have specified personal digest preferences in my ~/.gnupg/gpg.conf: personal-digest-preferences SHA512 SHA256 SHA384 SHA224 SHA1 then, I have generated a new key pair. But when I check the ...
0
votes
2answers
50 views

Is there a way to give out secure tickets wihout storing them?

I'm building a website on which I want to make it very easy for users to create pages anonymously and later be able to come back and edit those pages. One way to do so is to give out confidential ...
3
votes
2answers
921 views

big O for finding hash of length n O(2^n) or O(2^(n-1))?

note The wikipedia article does not use the big O notation correctly. Thus O(2n) just means 2n attempts I read on wikipedia (CGA) that finding a collision preimage for a cryptographich hash of ...
1
vote
3answers
67 views

Potential collision with hash password

Normally, the password size is fixed by the hash function in which the password is given right ? Because otherwise, if the password size is bigger than the hash result size, there should be potential ...
0
votes
1answer
14 views

Is the method of hardening the creation of a Cryptographically Generated Address (CGA) called hash extension

CGAs are sha1 hashes truncated to a 59 bit value. Along with a 3 bit security parameter they form a IPv6 address (more precisely the interface identifier). from wikipedia: The Sec parameter ...
5
votes
5answers
849 views

How secure is it to keep the salt with the password hash? [duplicate]

In Linux we have the salt just next to the password hash in the /etc/shadows file. I always hear that salt value prevents hashed passwords from being cracked by brute force methods. But if somehow we ...
2
votes
3answers
214 views

How can two parties compare whether a simple (5 letter) shared word matches, without disclosing their word to each other?

I'm having some trouble with this scenario, some advice would be great. The context is that a group of people have each been give a simple 5 letter word - for example: Alice: ACTOR Bob: JEANS Dan: ...
0
votes
1answer
23 views

Virtual Machine Integrity Hash Check

If I used virtualbox to create a snapshot template of a preconfigured linux machine and wanted to ensure that no one has tampered with my snapshot, could I simply keep a comparable hash of the VDI ...
1
vote
4answers
245 views

Why is a password accompanied by a username deemed 'safer'?

While browsing this community I notice that some people say that the main advantage of usernames accompanied by passwords is as they take more tries to be brute forced, however I don't think that is ...
1
vote
1answer
47 views

How to change personal cipher/digest preferences of existing OpenPGP key in GnuPG?

The OpenPGP key contains a list of personal algorithm preferences (the meaning of the numbers can be decoded in RFC 4880): # gpg -a --export "foo@example.com" | gpg --list-packets | fgrep 'pref-' ...
0
votes
2answers
86 views

Is there a cryptographic function that generates a reconizable visual pattern?

I have to build a system that will ultimately print a pass allowing access to a building. The validation of this ticket will be done manually (it can also be automatic but that's not likely at this ...
19
votes
3answers
2k views

How to replace an old password hashing method with a newer one in software? [duplicate]

The software that our company builds just went through a security audit. The auditors flagged our use of MD5 for hashing passwords that users can set if they want a password on their files. Having ...
0
votes
2answers
58 views

Getting the DNS root name servers in a secure way

It doesn't happen often that a root name server changes, but when it does sometimes it takes months for OS vendors to provide patches and in the mean time there is a security risk. So: How to get ...
2
votes
0answers
52 views

API Keys for REST [migrated]

So I'm developing a RESTful API, but I can't for the life of me understand how API keys work. I'm using PHP, which has an HMAC function, which I've read is a good way to sign requests, but what I ...
11
votes
5answers
2k views

Is this way of encoding cryptographic hashes safe?

I'm looking at the code of a particular web application that handle file uploads. For some reason, instead of using the cryptographic hash function (SHA-256 in this case), they derive an ID from it, ...
1
vote
1answer
120 views

Is This DIY Password Authentication Scheme Acceptable?

This is mostly a thought experiment for client/server communication, and I want to know the flaws. When a user account is created (with U as the username and P as the password,) I generate a random ...
9
votes
3answers
822 views

How secure are sha256 + salt hashes for password storage [duplicate]

I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
1
vote
1answer
65 views

Is it worth it to implement both SHA2 and SHA3 at the same time?

I'm creating a password storage system for a web server I'm building for fun. Would it be more secure for me to use both SHA2 and SHA3 for hashing, and then store them in a database? If I use both ...
0
votes
1answer
51 views

Can XOR be used in a Merkle Tree instead of concatenation?

I am trying to understand why, in a Merkle Tree, the concatanation between hashes is used - and not for example the XOR operation. Can they be considered the same for the purpose of a Merkle tree? I ...
0
votes
0answers
43 views

What is the format of PDF hash?

When I use a tool like pdf2john.py from John The Ripper on an encrypted PDF, it gives me an output like: ...
-2
votes
1answer
59 views

What hash algorithm is Disqus using now for users' emails? [closed]

Disqus previously used the MD5 algorithm to hash users' emails. A group of Swedes used a dictionary attack to reveal the email addresses (and in many cases identities) of hundreds of Disqus users, ...
2
votes
0answers
25 views

CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
0
votes
0answers
45 views

Designing a security system for road pricing

It's my first semester with Information Security and I still feel a little lost. Sorry in advance for stupid mistakes I may have made. the examples in round brackets below are my own ideas, wrote ...
5
votes
6answers
199 views

Is hashing a string a secure manner for generating passwords?

I have several servers that I'm using for an online business. I have passwords for MySQL, Wordpress, SSH, FTP, Domain Provider, Paypal, and many more. I wanted to have a different, very long password ...
5
votes
3answers
429 views

Any reason not to encrypt a 32 byte value by XORing it with a PBKDF2 hash?

Ordinarily I'd use PBKDF2 to generate a key which i'd use with AES. But seeing as the hash is going to be as long as the data I need to encrypt is there any disadvantage to just XOR'ing it? My ...
1
vote
3answers
52 views

What type of hashing method is used for the private key to encrypt for signing messages?

To use RSA for signing, Alice takes a hash of the message, encrypts the hash using her own private key, and appends the result (this is the signature) to the message. Eve can of course still ...
0
votes
2answers
112 views

Would my protocol be safe?

Suppose I have a protocol like the one below between users A and B; -A sends random nonce G1 to B -B sends back hash_k(G1) and random none G2 -A verifies hash_k(G1), then sends back hash_k(G1 | ...
4
votes
3answers
144 views

Secure Hash of a very short payload - is it possible?

I am looking to verify the integrity of a very small payload, approx 64 bytes, which will be stored in a QR code. I need to verify that the payload has not been generated or altered by an attacker. ...
0
votes
0answers
36 views

Understanding the application of hashes, HMACs, and KDFs

I think that I understand the right application cases for the following crypto functions, but I'd like to confirm my understanding and also propagate the safe use of crypto throughout the intertubes. ...
2
votes
1answer
86 views

Is there a benefit of using stateless JWT over SHA256 hash for API tokens?

Does it make sense to use stateless JWT (without persistent storage) over plain SHA256? Example scenario: User logs in User token generated as follows: a. JWT.encode(userId, 'secret') or b. ...
1
vote
2answers
100 views

Is it possible to crack hash with known salt? If yes how?

Hello folks, I was wondering , if the salt in the hash is known to us,then is it possible to crack to extract the password from the hash? If Yes, How?
2
votes
3answers
126 views

Can I initially hash passwords with SHA instead of hashing them with bcrypt to decouple requests from slow crypto functions?

I'm using bcrypt for some web service requests that hash multiple passwords. The problem is that these web service requests can take minutes to complete due to bcrypt. Not very user friendly. My ...
2
votes
5answers
163 views

Does publishing the md5sum of a private key compromise the private key in any meaningful way?

If I have a 4096 DSA private key used for signing binaries, and I want to ensure that a partner has an identical server using the same private key, can I send the md5sum of the private keys over an ...
19
votes
3answers
2k views

Why are MD5 and SHA-1 still used for checksums and certificates if they are called broken?

I was just reading about SSL/TLS stuff, and according to this site (which is rated as A by Qualys SSL Labs), MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And yet, I noticed ...
1
vote
1answer
50 views

Are multiple applications of a salted Linux MD5 hash easier to break than one? [duplicate]

I have hashed the same password a lot of times (approximatively 1000 times) using the salted Linux MD5 format. I want to know if it's easier to recover the cleartext password or not. Is there ...
2
votes
1answer
91 views

What is the best way to store passwords in OpenLDAP?

I would like to store user credentials in an OpenLDAP or similar directory server. A lot of online commentary about storing passwords in modern contexts recommends using password derivation schemes ...