A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

0
votes
0answers
4 views

Hashing sensitive data in request

We have set the https connection, between the client and server. The problem is that security guys, showed us it is possible to intercept the data using rogue invalid certificate (user must accept it ...
0
votes
1answer
26 views

Does stretching a hash increase a denial-of-service (DoS) risk and does brute-force protection mitigates that?

Disclaimer: I noticed several questions on this site but none really answer this two questions directly. Therefor I do not consider this duplicate. Personally I really like the article called Some ...
0
votes
1answer
36 views

Where do magic constants for signature algorithms come from?

For example, I've seen 3031300d060960864801650304020105000420 as an identifier for RSA/SHA256, 3020300c06082a864886f70d020505000410 for RSA/MD5. Where do these values come from? I ran into one of ...
0
votes
0answers
32 views

Symmetric/Asymmetric/Hashes Strongest to Weakest & Rounds

I am well aware strongest to weakest in terms of hashing, however, I have been reading about rounds to do with hashing. Also, discovered symmetric/asymmetric e.g. AES, Twofish etc have rounds also. ...
-4
votes
1answer
40 views

Need help identifying cipher (hash type?) [on hold]

This is it: c6dd657d235344b4fcbf5ba88a47550d6992d16e It probably contains coordinates. Not sure tho.
0
votes
0answers
38 views

Hashing with unknown salt security

First off, this question is not about password hashing, my requirements are different. In particular I fully agree that salts are not useful for adding cryptographical complexity in password hashes, ...
3
votes
2answers
329 views

Storing Password Hash plaintext

I've been doing some research on password hashing/salting. It is my understanding that the salt doesn't need to be secret. But I haven't read anything about the hash itself needing to be secret. How ...
-2
votes
3answers
178 views

How hard would it be to crack bcrypt hashes if the salt is unknown? [duplicate]

Let's say an attacker has offline access to a database in which passwords are hashed with bcrypt (no pepper added). The hashes look like: $2y$10$H0mRpD2XJZDguAzxTehwzunRkjUR8lB3O4UGrAGLiqJuvnlWjFA7G ...
0
votes
0answers
29 views

Why is it so hard to make longer hashes? [migrated]

I was reading this answer about why there is no such thing as a SHA-1024 hash: SHA-2 was built with state and word sizes to meet the security requirements on commodity computers (x86 and Alpha), ...
3
votes
4answers
962 views

Convert SHA-256 to SHA-1 and MD5 - Increase bit length/entropy? [duplicate]

I know this is a real dumb question and I am certainly talking complete rubbish, but let me explain: We have a long SHA-256 hash, e.g.: ...
84
votes
9answers
15k views

Does anybody not store salts?

We talked about password hashing and salting in class today. Our professor had a very different understanding of the use case of salts from mine and said that you might not store the salt at all and ...
1
vote
0answers
107 views

Find salt from md5 hash if password is known

I have a salted MD5 hash and I also know the password. How can I recover the salt using tools like John The Ripper (I have JTR jumbo installed)?
1
vote
3answers
162 views

Is hashing passwords with bcrypt and a constant salt more unsecure than SHA1?

I've built an API that allows users to submit encrypted data to be stored in the cloud. To retrieve their data, the API requires the user to supply only the MongoDB Object ID that they are given when ...
1
vote
0answers
51 views

Create reduction functions in rainbow tables

I have been trying to understand rainbow tables lately and one part is giving me trouble to understand here. Let's say I want to generate a table where the chains are 100 000 hash/plaintext long. I ...
0
votes
1answer
52 views

Setoolkit - credential harvester, only display the first character of the password

I'm launching a spear phishing campaign and my client has specifically asked me to only harvest the first character of the password, is there a way to do so? Basically instead of showing the whole ...
1
vote
0answers
34 views

Using hash of root password to encrypt files/folders (Debian 8 Linux)

I have an application that requires unattended decryption of files/folders. Would it be possible to utilize the hash of the root password to prevent an attack where a malicious user changes the root ...
3
votes
2answers
77 views

Would a Password Using All Possible Unicode Code Points Cause Problems in Traditional Hashing Algorithms, such as Bcrypt?

I've been toying around with this idea, but hypothetically, if you had a password manager that would use any possible renderable (e.g. not control characters such as BEL, NUL, DEL, etc., or surrogate ...
-2
votes
3answers
152 views

Is it possible to reverse MD5? [duplicate]

I'm new in the security world and right now I'm studying about hashes. Let's say I have md5(x+q) and md5(y+q). I know the value of x and y hidden into md5. Would it be possible to reverse it and ...
-4
votes
1answer
85 views

Does combining two encrypted strings secures password? [duplicate]

For example, a person having password 123456. it's MD5 is e10adc3949ba59abbe56e057f20f883e and SHA1 is 7c4a8d09ca3762af61e59520943dc26494f8941b and after joining both hashes. Which comes to be ...
0
votes
2answers
118 views

Why is it a problem to store strong passwords as unsalted hashes?

My users all have strong (80-bit true entropy) passwords. How do I know that? Because my imaginary website randomly generates the passwords for them (client-side). In that context, could you explain ...
-12
votes
1answer
88 views

I have an MD5 encrypted link. How do I decrypt? [closed]

I have this MD5 hash of a link: 687474703a2f2f696d6775722e636f6d2f45554a43734742 I only have this code, no other information. How can I crack it?
3
votes
1answer
51 views

Help converting string to NTLM

I'm trying to covert a string into a NTLM hash. From what I understand you just have to covert the characters in the string to unicode, format it to little endian and then hash it with the MD4 ...
-3
votes
1answer
103 views

How to get secure hashing software? [closed]

I am searching for an open source hash calculator that I can download to verify my Tails .iso image, but I also want to be able to to calculate some password hashes with a sha512 hash (which is why I ...
2
votes
2answers
61 views

Using a hash in place of user data

I'm storing client data and they are sensitive about privacy and security of the data. In some cases, I don't need the actual data, but could work with a hash of the data. For example, in the case of ...
3
votes
1answer
77 views

Besides Browsers, what other Technologies are Impacted by the Deprecation of SHA-1?

I am aware that from January 2017, browsers will start rejecting, or at least warning, users browsing sites offering SHA-1-signed certificates. Would a service be impacted if the system does not ...
2
votes
0answers
12 views

hash function notations and existing cryptographic hash algorithms [migrated]

I am implementing Role-based access control by referencing the paper Enforcing Role-Based Access Control for Secure Data Storage in the Cloud. In page 6, they have mentioned to choose hash functions ...
-6
votes
2answers
55 views

How to brute force this token in php, if it is possible

it is possible to brute-force this token (MD5 Hash) of the following script (PHP) in a realistic time (0,5h - 24h)? If the answer is YES, how could I do it, for example with PHP or Python? $time = ...
0
votes
4answers
101 views

How are salts safe in the database? [duplicate]

I have read many and many of this type of question on the security stack community before I asked this question, but one thing that made me mad about salts and saving it in database is this ... I will ...
3
votes
1answer
79 views

Recommended Crypto Security Setup (Implemented Algorithms)?

Firstly I'm not a crypto expert, however I know how to use algorithms that other people have defined before in practical usages, that is, as long as they live up to their promises. The thing is that ...
3
votes
2answers
101 views

Does a hash of a 32-bit integer make a better hash salt than the integer itself?

I have a scenario where I already have a table of resource passwords stored as unsalted 128-bit hashes. I'm unable to force owners to provide new passwords, so I'm trying to mitigate the situation by ...
0
votes
2answers
100 views

How secure is the hashing/salting/stretching process as described in this diagram?

Question I was just brainstorming about the hashing, stretching, salting part of the user password in the authentication process and I want it to be as secure as possible (no matter how paranoid that ...
2
votes
0answers
94 views

Any vulnerability in .net implementation for C# object.GetHashCode?

I've already asked this question on SO, but I think that this forum is more appropriate to discuss security issues. My point is that most OO languages has a way to get a unique hash code for an ...
1
vote
1answer
75 views

How secure is the UNIX sha_crypt as a password storage algorithm? [duplicate]

So I have been working on password storage, especially on the algorithms to use (and to not use). Most people are recommending scrypt or PBKDF2 for valuable reasons, but I have not seen any talks ...
-1
votes
2answers
135 views

How long would it take to generate a file to match a hash? [duplicate]

A individual file only has a single hash of any specific byte length. But an individual hash can represent a large number of different files. Given a 256 byte hash, how long would it take to ...
-1
votes
2answers
79 views

Website says my new password can't be used because it is the same as an old one [duplicate]

What are the risks of storing (in hashes I guess) all the old passwords? Why would a company chose to not delete old passwords? Why not let users reuse old passwords?
7
votes
2answers
164 views

Is there any recommended approach for “upgrading” MD5 hashes to something secure? [duplicate]

I'm currently dealing with a couple of user accounts containing MD5 hashed passwords. These accounts got migrated from an old system into our current system which uses PBKDF2 for password hashing. I ...
0
votes
0answers
37 views

ISO 9564 Approved Encryption Algorithms for PIN, why symmetric block ciphers?

I am currently researching best practices in designing a potential PIN management solution for a financial services application and began looking into ISO 9564 as a source of requirements. One of the ...
27
votes
3answers
4k views

Can I share what password hash function I used in a public report?

I have developed a web site during an internship, using a database with accounts. I used the crypt() method from PHP, with a secured algorithm plus salt (found on the web with a lot of feedback). ...
-5
votes
1answer
132 views

Where do webstites store the hashes? [closed]

I understand that lots of websites store passwords in hashes but where do they actually store the hashes? How can a website compare your hashed version of a password with theirs? Is it stored ...
1
vote
1answer
76 views

Is using dynamic obfuscation and peppers for password hashing a good idea?

I've read now the whole day about password hashing and secure authentication and though I read very often that mostly every own algorithm makes the proven hashing methods just less secure, I just got ...
1
vote
1answer
97 views

Password Encryption For PHP 5.3 or Should We Update to 5.5+?

I'm trying to hash passwords for our company site. After testing on a local Apache server that has PHP 5.5.9 and everything working as expected, I went to test on our live server being hosted by ...
0
votes
0answers
49 views

How to extract the hash from SMB

I have a running PC which I need to test against.It is running Windows with SMB enabled. When capturing using Wireshark while connecting with an incorrect password I see packets being sent to / from ...
0
votes
1answer
40 views

If domain admin account's NTLM hash is compromised, can it be used to access any machine in network

If a hacker able to get local admin rights and then from there local domain admin's NTLM hash. Can he use this hash without cracking, to access shared folders in the network and the default C drive ...
0
votes
2answers
107 views

Secure password generation for different websites [duplicate]

I came up with the idea to generate passwords for internet sites by the following shema: $masterpassword $hostname $TLD hashfunction($TDL.$masterpassword.$hostname) So the actual password is a ...
1
vote
1answer
75 views

Firmware protection scheme

Edit: I have found a scheme that fits my limits (little memory, only AES is available): AES-CMAC described in RFC 4493 (just remember to use different key for encryption and MAC ;) . I am working ...
1
vote
3answers
270 views

why don't we store passwords in a database using encryption instead of hashing? [duplicate]

hashing is a one way method, if a user lost his password he will never be able to get that password from the server, so why don't we store passwords in a database using encryption instead of hashing?
2
votes
1answer
190 views

Which file encryption algorithm is used by Synology's Cloud Sync feature? [closed]

I'm trying to find out which encryption method is used by a piece of software I use, viz. the 'Cloud Sync' feature of Synology's DSM 6.0 running on a Synology NAS. (Background. This Cloud Sync ...
-3
votes
2answers
98 views

Will hashing a password, and then splitting it into multiple db fields increase security? [duplicate]

I've been reading up on Password hashing, and it seems like there is a lot of opinions on "What's right." I'm curious about the possibility of storing a split of a Hashed password in multiple user ...
34
votes
5answers
5k views

Should I trust a website which uses a SHA-1 HTTPS certificate?

I am on a website where I need to pay for something. This website has the following warning in the top left: This site uses a weak security configuration (SHA-1 signatures) so your connection ...
0
votes
0answers
20 views

Securing FTP Creds in a Java Open Source API

I've written a basic Java API and source code must be released to a small community for the application to function correctly. The Java API helps developers track data for their running scripts and ...