2
votes
2answers
52 views

Related-password hash security

Say we are given a strong cryptographic hash function hash(), a strong completely random password of 15 characters pass15, two single-character salt values salta, saltb. We compute the hashes hasha, ...
0
votes
2answers
52 views

What is the collision likelihood of MD5 when non-numeric values are removed?

Start with a unique identifier String macAddress = "CC:3A:61:24:D6:96"; Hash the identifier via MD5 implementation String hash = md5(macAddress); //bd37f780e10244cf28810b969559ad5b Remove all ...
0
votes
2answers
149 views

Reversible Hash Function?

Is there any reversible hash function? The hash function like SHA and MD5 are not reversible. I would like to know if there exist some reversible hash functions?
0
votes
1answer
98 views

Advice on using encryption and hashing

I'm going to rephrase a question I asked earlier, as I don't think anyone understood what I meant. Bascially I'm writting a web based password locker, which can have multiple accounts; so that users ...
0
votes
1answer
56 views

Using encryption and hashing

I'm writing a project to securely store and share passwords between users, I've been doing tons of research into encryption algorithms, CSPRNGs, hashing algorithms, key stretching etc... I just want ...
1
vote
1answer
100 views

What are the enhancements of SHA1 compared to MD5?

I am looking for enhancements of SHA1 when its compared to MD5. But I am not talking about just heap sizes. I am talking about different enhancements than heap size. Also, I think md5 is faster than ...
0
votes
1answer
119 views

How do we estimate the time taken to crack a hash using brute force techniques

A German hacker famously managed to brute force crack a 160 bit SHA1 hash with passwords between 1 to 6 digits in 49 minutes. Now keeping everything constant (hardware, cracking technique - here ...
2
votes
1answer
81 views

Stream/Block encryption using XOR and Hash function?

Could a hash function like sha1 or ripemd-160 be used for secure key generation in a stream/block cipher? Obviously a repeated key like "abc123abc123abc123" would be bad, and a one time key pad would ...
0
votes
1answer
43 views

Is it safe to use the Keccak Algorithm to create the Key for a Serpent cipher?

I like to store some configuration but would encrypt them with the Serpent cipher. Is it safe to do this? When not, what is a better solution?
1
vote
1answer
90 views

Hashing password for secure storage (generating salt)

I wanted to check if the following means of generating a hash for storage of a password was secure. I have an username and password combo. In order to generate a secure hash, I am doing the ...
0
votes
0answers
200 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
0
votes
3answers
115 views

Cryptosytem Question [closed]

A file is encrypted and placed on a secure FTP server. An MD5 hash is taken of the file and also placed on the FTP server. A userlogs in to the server and downloads both files, however, the hash fails ...
0
votes
1answer
67 views

Cryptographic Hash function [closed]

How can I implement a cryptographic hash function using the block cipher? I was wondering whether I can use AES in cipher block chaining mode to achieve this.
0
votes
1answer
78 views
1
vote
3answers
366 views

What is the correct way to make a password salt?

I've made the below function to make a completely random 64 character long hash function password_salt($password){ $salt = hash("sha512", mt_rand(1,100000) . strtotime("now") . $password . ...
121
votes
8answers
9k views

Why are salted hashes more secure?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...
0
votes
1answer
133 views

Is it possible to insert data into UUID?

Is it possible to insert arbitrary data into UUID? Let's suppose we have an MD5\SHA hash of something... can we encode that data into a valid UUID?
1
vote
3answers
970 views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
9
votes
1answer
184 views

Securing a prediction about a future event

I want to make a prediction about a future event, but only reveal that prediction after the event occurs lest knowledge of my prediction affect the outcome. For example, suppose Alice predicts that ...
3
votes
2answers
156 views

Hashes of overlapping data - does it make them easier to crack even when neither is cracked

Say I have strings: stringA, StringB, stringC. And I make two hashes: HashA = sha256(stringA + stringB) HashB = sha256(stringB + stringC) For the sake of the argument I'm suggesting sha256 but ...
1
vote
2answers
181 views

Hashed Database: Hash Functions

Let's assume there is a database containing names and each name is hashed and the clear-text is deleted. If an attacker were to steal this database, would he/she be able to get the list of names?
-1
votes
2answers
172 views

Is AES feasible for secure hashing files? [closed]

There was already a similar topic "Why AES is not used for secure hashing, instead of SHA-x?", but it was not about files specifically, and I, personally, am not convinced by the answers in it. "AES ...
4
votes
2answers
446 views

Is it safe to use PBKDF2 for hashing?

I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
0
votes
0answers
58 views

Does the ordering of encryption and hashing matter? [duplicate]

I am now learning keyed hash function, where A and B share a secret key k. I want to know if the ordering of encryption E and hashing H matters? i.e. Is there any difference between H ◦ Ek (m) and Ek ...
8
votes
4answers
535 views

At what point does adding more iterations to PBKDF2 provide no extra security?

If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an ...
0
votes
1answer
72 views

Payload authentication + HW-SW Binding

I want to authenticate a (2nd stage) bootloader during the boot process using a symmetric key, which is derived from HW properties of the platform the bootloader is running on. Thus, I want to bind ...
4
votes
3answers
345 views

comparing password hashing algorithms - PoC ideas?

OK so I just started working for a security consulting firm and we recommend SHA 256 (with salt) for password hashing because MD5 is too weak. I have read some brilliant answers (the list is too ...
0
votes
2answers
412 views

Algorithm to generate NTLMv2 Hash in PHP

I am trying to develop a PHP function to calculate NTLMv2 hash by providing server & client challenge, domain, account and password. The resulting hash appears to be not correct. Can someone ...
3
votes
1answer
667 views

Hashing passwords before inserting into database

For the last 2 weeks I have been reading many blogs about website security and hashing passwords. Many sites have mentioned the pro's and cons about different ways of doing this, which has left me a ...
6
votes
2answers
364 views

Salt placement prior to one-way hash

In one-way hashing its common to prepend or append the salt to the secret and then hash it: (salt + secret) or (secret + salt). I was thinking of this metaphor as salt falling on a plate of food. It ...
4
votes
2answers
878 views

Rounds of MD5 and SHA512 Hashing Algorithms

What is the exact number of rounds employed by the MD5 and SHA512 hashing algorithms? According to various sources, the SHA512 hashing algorithm employs a total of 80 rounds ...
6
votes
3answers
1k views

How exactly is MD5 vulnerable to collission attacks?

I've often read that MD5 (among other hashing algorithms) is vulnerable to collisions attacks. I understand the collision part: there exist two (or more) inputs such that MD5 will generate the same ...
7
votes
1answer
352 views

HKDF and key stretching

I thought that all key derivation functions would do a key stretching phase, by iterating some kind of process. But I can't see that process in HKDF. HKDF doesn't do key strengthening? If I have a ...
2
votes
3answers
128 views

User specified iteration count

I'm working on a PHP authentication and registration system following the standard salt+password = 'auth hash' and using the plaintext/unencrypted username as the lookup field on the initial query. ...
2
votes
2answers
180 views

Does glibc2 version of the crypt function still use DES for alternative hashing methods?

I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
2
votes
1answer
253 views

Hash extension(padding) attack

I recently came across this website talking about sha1 padding attack. http://www.vnsecurity.net/2010/03/codegate_challenge15_sha1_padding_attack/ After reading here are some of my doubts: How ...
3
votes
1answer
254 views

How to determine hashes/second in password cryptanalysis

I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt. I'd like to ...
6
votes
3answers
498 views

NTLMv2 resistance to bruteforcing

I have a question regarding NTLMv2 resistance to password bruteforcing. I know that some modern graphic processors (like Radeon 6990) are able to calculate billions hashes per second and crack NTLM ...
10
votes
4answers
1k views

Is there a length beyond which increasing password length provides no additional security?

Assuming that the password is stored hashed and salted, and that it is a string of random characters, is there a point where adding to password length doesn't add security? Since the hash will have a ...
1
vote
1answer
57 views

Parameters in output of password hashing function

A number of encryption functions include their tuning parameters in the output. For example, SCrypt, which I've been considering for an app I'm building, outputs in the following format: ...
17
votes
2answers
10k views

Why are GPUs so good at cracking passwords?

What is it about GPUs that lets them crack passwords so quickly? It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
2
votes
2answers
495 views

Does it make any difference of the order Hashing and Encrypting in terms of security?

I am implementing a password vault program with java. I have programmed a triple DES for encryption and a SHA256 for hashing. My question is would it make any difference if I first hash the raw data ...
2
votes
2answers
339 views

How high is the entropy of this salt-generating code? (No code-reading actually necessary)

What is the best method? Assumption: I have a function that generates a number of medium-high entropy bytes Step1: I generate 3 of these medium-high entropy bytes. Step2: I hash these bytes using a ...
3
votes
5answers
821 views

The security level in hash function

What is the difference in security between using part of message digest hash function or all the message digest hash function? and is there any equation can calculate the security for part or whole ...
2
votes
1answer
668 views

sha-512 vs sha-3? [duplicate]

Does the new SHA-3 Keccak hashing algorithm offer any benefits from SHA-512? "Even worse, none of the SHA-3 candidates is significantly better. When SHA-3 is announced, I'm going to recommend that, ...
0
votes
4answers
440 views

Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?

I am creating a page on a website that will show a user some authorized information from another website, and that website uses a combination of the user's user-number and a secret passphrase hashed ...
5
votes
3answers
406 views

Use of rainbow tables with the NY Times hack?

The NY Times recently published a story about how they were hacked during a four month period. The hacks allegedly were carried out by part of the Chinese military. One part of the story that ...
2
votes
2answers
148 views

Easy protocol for email authentication

I'm cooking up a very simple system to send commands to a remote server via email. Everytime an email is sent to do_something@mydomain.net, the server runs a python script that does something ...
1
vote
5answers
859 views

Is SHA-1 encryption?

I have read that SHA-1 is a cryptographic hash function. On an exam, SHA-1 was given as a possible one-way encryption algorithm. Does SHA-1 require a key as input? Is a key required to qualify as ...
3
votes
3answers
616 views

Hash Function Xor

For a hash function what is the best secure method, XOR or Concatenate: h(data1 XOR data2 XOR data3 XOR data4) ? or use h(data1||data2||data3||data4)?