A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

0
votes
0answers
9 views

Is it possible to pass the hash with a hash captured from spoofing NBNS responses?

I know that it is possible to use a hash obtained from the Windows SAM in a pass the hash attack, simply setting the hash for the SMBPass paramter for various modules in metasploit. Can a hash ...
1
vote
1answer
31 views

Identifying hash format caputred via Metasploit

When I use the nbns_repsonde module in metasploit, and set it to write captured responses to a file in the john format, I get a file with lines such as this: ...
1
vote
2answers
43 views

A secure way to encrypt a connection between 2 clients securing against both passive and active adversaries

Recently I got interested in encryption and the methods behind them. So for a fun / school project I am building a program in python to encrypt data between two clients (chat and files). I'm just ...
-7
votes
0answers
22 views

security Telecom (LTE,IMS,,..) [on hold]

helloo all can any one tell me list of web site specialized on telecom security (LTE,UMTS,IMS,....) or a book and thanks in advanced
0
votes
1answer
40 views

PHP: Save e-mail address hashed or plain [duplicate]

I've been wondering about something, is it more secure to store an encrypted (hashed with password_hash) email address in the database, or just as plain text? I've google'd this matter and saw that ...
0
votes
1answer
58 views

Please help clarify password hashing - salted, multiple iterations of MD5 vs bcrypt/sha2, etc [duplicate]

I was reading an article about the Ars Technica hack here and had a couple of questions. The commenter said: "PHPass uses salted and iterated MD5 to hash passwords" My question is that if I were ...
1
vote
0answers
38 views

Possible hashing scheme [migrated]

Plaintext(binary) : 10101100 //very short for easy understanding Suppose we have 4 predefined schemes/functions, rotate (101 -> 011) flip (1101 -> 1011) exchange (11011 -> 10111) stretch (1100 -> ...
0
votes
2answers
49 views

Separate database column for salt

Is it advisable to store the salt in a separate database column or should we concatenate it together with the password? Is there any difference? I have come across implementations of both types. ...
3
votes
0answers
41 views

What's the best way to transform sensitive account numbers

I work on a web application that manages information about transmission setups and processes client transmission statistics to generate billing charges for the services used by these clients. The team ...
9
votes
1answer
248 views

Torrent “bad seed” attack by Sony, how does it work?

Sony recently saw a large amount of data stolen. In order to prevent the stolen data from being spread using torrents, they are doing what was called a bad seed attack. What is this attack? Is this a ...
2
votes
1answer
136 views

Reverse Engineer this basic Hash using known answer?

Little background: I forgot one of my CCTV accounts password, so used the admin account to create a new one. However I can't access the old one as it's not possible to change a user account password, ...
2
votes
0answers
36 views

HMAC-SHA256 Transaction signing [on hold]

Can rfc6238 be used for transaction signing by concatenating the random seed string with transaction details (such as amount and target account number) ? Could a transaction authorization 8-cipher OTP ...
1
vote
0answers
44 views

Passing the hash with metasploit and psexec not working - why? [closed]

I am currently doing a penetratiion test, and have captured a bunch of NTLM hashes via NBSN spoofing. An example (this is not taken from what I captured, and is random but the format is the same) ...
1
vote
2answers
393 views

PBKDF2: can the salt be known from the hash?

I understand that some KDFs bundle the salt with the output, such as bcrypt (modular crypt format). In PKCS5_PBKDF2_HMAC (specifically, looking at OpenSSL implementation) with a single iteration, is ...
0
votes
1answer
39 views

Verify CDN javascript's integrity

CDNs speed up the loading of websites by allowing caching for frequently used javascript libraries like jquery. How do we know if they have modified the javascript before serving it to my clients? ...
1
vote
1answer
51 views

find out the algorithm based on some examples?

I have an OTP generator that receive two numbers less than 99 as input and return an 8 digit number as its output. I know it has a simple algorithm. because its processor is just an ATMEGA8 micro ...
2
votes
1answer
94 views

TrueCrypt VS LUKS Bruteforce Resilience

I have been researching LUKS vs TrueCrypt topics -- my only concern is security, but most of the discussions I see focus around usability / interoperability . I know TrueCrypt has a bunch of nice ...
-1
votes
1answer
31 views

Why not use md5 auth mechanisms for IMAP over TLS?

I'm using Dovecot for IMAP connections. I've read a lot of tutorials on how to set up Dovecot, and a lot of them said to only allow: auth_mechanisms = plain login Why should I not allow *-md5 ...
21
votes
4answers
4k views

Do I have to hash users' IP addresses when I log them?

I have read a lot of users saying that you have to hash IP addresses - and a lot of others who say I don't have to because it is not private information. I use IP addresses for identifying users, ...
2
votes
3answers
134 views

Are there any flaws in this two way cryptographic function?

I created a simple two way cryptographic function which allows you to encrypt a message and decrypt it with the same key. Here's how it works. Split the message into an array of 32-bit (or something ...
0
votes
1answer
48 views

PKI - Security concerns when changing a certificate hash algorithm

Suppose I want to change the hash algorithm used for a certificate signature (ex: SHA1 to SHA2). Is it better to revoke the previous certificate and issue a new one with expected hash algorithm ? Or ...
-3
votes
1answer
47 views

Authentication protocol based on hash function [closed]

Is it possible that Alice can authenticate Bob without using any secret information except her password, i.e they don't share any thing else. If so, how can I authenticate Alice and ensure the ...
0
votes
0answers
45 views

Detection of pass the hash

I have researched about PTH Attacks but yet found any solid way detecting it in a network.is there a way to detect a pass the hash ? analysing the windows message from the dcs or something ?
5
votes
6answers
2k views

Techniques to make a login page safe without using SSL

I am developing a web page where people can write and comment things (no personal informations required) and I need to put a log in form so users can see all their actions on my web page. My idea is ...
31
votes
5answers
2k views

Password Storage - Self Encryption vs Hashing?

Self Encryption: Encrypting a password using the password itself (as a symmetric key). Basically, by doing this, I'll get random data as an output. Now, in order to retrieve the password from this ...
1
vote
1answer
119 views

What is the right way to implement Keyed Password Hashing?

As mentioned in this wonderful link, the way to get a PBKDF2 Hash of a user given password given a password (of course), a salt (generated Cryptographically Secure Random Number Generator. iteration ...
18
votes
5answers
3k views

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...
5
votes
4answers
198 views

Are there any disadvantages to encrypting the password hash?

Is encrypting the password hash in database more secure than storing only the hash? Suppose we store encrypted SHA-256 result with AES instead of hash directly. Is this a good protection from a ...
1
vote
1answer
36 views

Using salt or secret for Hmac

I'm working on a web API. We are going to use Hmac256 for signature hashing. From what I can gather, the secret is a key used to initialize the hash algorithm (ie to generate a random number). The ...
1
vote
1answer
98 views

How are SHA1 and MD5 considered to not protect against collisions?

SHA1 and MD5 hash functions are considered to not protect against collisions while SHA2 is. Is it the size of the message digest that makes this or the algorithm itself? If it is based on the message ...
1
vote
2answers
54 views

bscrypt,scrypt v/s iterative SHA-x [duplicate]

Both bcrypt and scrypt hashing algorithms are designed to increase the resources required during the computation. Hashing passwords with these algorithms can be beneficial as it makes the task of an ...
2
votes
1answer
31 views

Feeding PBKDF2 to SRP verifier creation

There is an older game that solely uses UDP to communicate, and I wanted to add password authentication to the game to facilitate things like experience points and rankings. To this end, I decided to ...
2
votes
3answers
110 views

Can password_verify() be used to identify password after database breach?

I am a newbie to PHP and password hashing. I am following the instructions provided here to hash my user password before storing. My questions are: PHP recommends password_hash() method as a ...
1
vote
2answers
76 views

Storing AES password for verification

I was wondering if such practice would be safe: I have a table that stores encrypted notes Every note has a data field and a password field When a password is entered, i want to select all notes, ...
1
vote
2answers
152 views

Stream/block cipher add a simple hash to guarantee integrity

The question is simple: Adding a hash to a message and then encrypt it using a stream cipher / block cipher. Why can't this guarantee integrity of the message upon decryption?
-8
votes
1answer
137 views

Someone help me decode this [closed]

What type of hash is this? a9df6dcd35f4e7223ff3dd087abcc266 I can't find anything when I decrypt it. Please someone decrypt it
2
votes
1answer
128 views

How Windows Server 2008 Stores Local Users Passwords?

It is not clear to me how Windows Srver 2008 R8 stores local account passwords. Is there any salt added or just NT hash is computed and stored. The following article describes all the methods used by ...
27
votes
2answers
4k views

How bad is it to truncate a hash?

I'm wondering how bad it is to truncate a SHA1 and only compare, say, the first 10/12 bytes, etc. I'm working with a fixed length of 8 bytes that I need to hash for uniqueness but store with the ...
3
votes
2answers
114 views

Similarity comparisons with hashed passwords possible?

At a company I worked at, I had to change my password every 90 days and I could only reuse a password after 8 iterations. This no-reusal included passwords being too similar to the old one, e.g. when ...
1
vote
3answers
104 views

Site allows both Partial and Complete password authentication; do they have my password in plain text? [duplicate]

My bank provides online banking facility like most of the banks these days. On the web they have Partial Password Authentication. Although I don't really believe in PPA providing extra security but ...
1
vote
1answer
60 views

Multi hash security [duplicate]

Is md5(sha1(pass)) more secure than md5(pass)? For example in case of sqli when attacker cant get our hashing schema, brute force or dictionary attack would be much less efficient. Am i right or is it ...
-2
votes
2answers
65 views

Strength of WPA passwords

How long would it take to crack an 8 letter (latin alphabet, lowercase) password of a WPA PSK network? Is it in reach of a single PC running hashCat?
20
votes
6answers
2k views

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

I'm cross posting this question from Programmers.SE because I think it's equally on-topic here and would like to pose the question to this community as well. This seems like a programming question ...
3
votes
1answer
65 views

Are there any ways to leverage NTLM V2 hashes during a penetration test?

I am on a penetration test at the moment, where LM/NTMLv1 hashes are disabled. I have captured a number of NTLMv2 hashes via NBNS spoofing, however was unable to crack them after running them through ...
0
votes
2answers
101 views

Are there any good tools to test the encryption quality of data?

I am trying to increase my understanding of data encryption, and I was wondering this. It would be really nice if there were any good tools to test how secure my encrypted data is, for example how ...
3
votes
1answer
251 views

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

This is going to get long, so prepare. Basis of the question is, Do all these steps improve security, or am I completely overthinking the problem? Are my assumptions/thought process valid? We all ...
0
votes
2answers
55 views

What is the solution for handling exceptions in password hashing schemes?

There is a technique called password hashing that describes creating unique passwords based on a unique master key and a static and arbitrary hash value. Using this technique, the user only has to ...
-4
votes
1answer
102 views

How does https check md5, sha-1 and sha-2 fingerprints?

When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient? This question arose ...
43
votes
8answers
6k views

Do bad passwords produce bad salted hashes?

When you have a password stored in a database that has been strongly hashed and salted does it really matter if the underlying user password is weak? If you setup features like limiting login ...
1
vote
2answers
59 views

XOR-Cascade of weak hash secure?

I have following theoretical question: Let H(X) be a hash function which is considered as weak because collissions can be produced (e.g. SHA1, MD5). I wonder if following functions: H2(X) = H(H(X)) ...