-3
votes
0answers
51 views

Trouble identifying a has [on hold]

So I have this hash: +VZyZlAHP6HAgoaPBrBz with a known plaintext value being 378734493671000. For the life of me I cant figure out what kind of hash this is. I have 2 others I need to decrypt as well: ...
0
votes
1answer
87 views

How to decode/decrypt strings of text [closed]

So I'm trying to decrypt/decode some text strings. I don't believe they're hashes because they vary in length too much and the software they are used for is able to easily decode them and display them ...
0
votes
3answers
95 views

Is is necessary to encrypt the message digest?

In symmetric key settings, in order to provide the message integrity, we compute the hash of the message. The message along with the message digest is then encrypted. Is it necessary to encrypt the ...
13
votes
3answers
1k views

Trying to understand why signatures in root certs “are not used”?

Taken from here: Don't worry if the root certificate uses SHA1; signatures on roots are not used (and Chrome won't warn about them. Why are the signatures not used? Are not root certificates ...
0
votes
2answers
64 views

Is my Password Hashing Secure or not?

I have recently created a code for hashing password. Can you please give your advice over the security of my code? The function takes a password, then converts it to a number. #include <string> ...
0
votes
1answer
48 views

encrypted lookup-keys for key-value store

I'd like to use a key-value store (cassandra, redis, ...), but I don't trust the server. The clients have a shared secret, and I'm using that to encrypt the stored values. But what is the proper way ...
2
votes
1answer
153 views

Is encrypting something more than once safer than hashing more than once?

I am aware of the implications that hashing something more than once correctly will increase the security of a system, but doing it incorrectly will decrease it, as noted here and on various other ...
-2
votes
2answers
52 views

Identifying/decrypting hashed/encrypted data [closed]

This weekend I took part in an security challenge. I had great fun doing it but i found a huge gap in my knowledge that I'm really keen to fill and hope someone here can help get me pointing in the ...
1
vote
0answers
22 views

PBKDF2 hashing over TLS for encrptig password [closed]

i wanna use PBKDF2 hashing over TLS for encrypting password and session and that way stop hackers from breaking into my connection. How to do it in java.
-1
votes
4answers
299 views

What if I develop my own hash algorithm to create strong passwords from easy ones?

I came up with this idea but I cant figure out if it's good or bad, maybe you can help. My goal is: I want to create extremely strong passwords for my main accounts (gmail, skype and so on). I want to ...
1
vote
1answer
124 views

Advice on using encryption and hashing

I'm going to rephrase a question I asked earlier, as I don't think anyone understood what I meant. Bascially I'm writting a web based password locker, which can have multiple accounts; so that users ...
1
vote
1answer
70 views

Using encryption and hashing

I'm writing a project to securely store and share passwords between users, I've been doing tons of research into encryption algorithms, CSPRNGs, hashing algorithms, key stretching etc... I just want ...
0
votes
2answers
96 views

Is a long salt usually sufficient for security purposes, even with MD5?

I always hear that MD5 is too fast for effective password crypto because you can crack up to 6 characters very quickly (or is this number higher now)? But what if the salt you use is really long and ...
0
votes
2answers
78 views

Security of this account login system

I have an idea to implement a account system using email and passwords for games. Im intending to have the account creation and forget password systems on a webpage. So if users will have to access ...
1
vote
2answers
41 views

Can I save & store a user's data in a way that proves that the information has not been altered, and that the timestamp is accurate?

There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service ...
0
votes
4answers
535 views

What are the advantages/disadvatages of hashing over encryption?

I know that hashing is a one way function and encrypted messages could be retrieved if you know the corresponding key to which you encrypted the message. Other than the ability to retrieve, what ...
0
votes
0answers
43 views

Algorithm to Transaction Data Signing

Transaction Data Signing I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device. What is the idea? The ...
2
votes
1answer
99 views

Stream/Block encryption using XOR and Hash function?

Could a hash function like sha1 or ripemd-160 be used for secure key generation in a stream/block cipher? Obviously a repeated key like "abc123abc123abc123" would be bad, and a one time key pad would ...
0
votes
2answers
190 views

Is there any issue using the PHP crypt() function with an additional salt?

Is my PHP authentication script secure? I noticed that the hashes start with the first two letters of the username. Could there be a security flaw using crypt() in such a way? <?php // ...
0
votes
2answers
119 views

Asymmetric Data Storage+ No-Hash Password Storage?

Edit: removed a part of the original question; I'll break it down in a different post. I am following @Polynomial's answer to store information in a database. Here are my requirements: Only the ...
6
votes
5answers
2k views

Whenever an unhandled exception somehow makes it into production, is it safe, viable, etc. to print an encrypted stack trace to the end user?

Whenever an unhandled exception makes it into production somehow - whatever the reason - there's generally an option (especially with .NET programs) to print out a stack trace to the end user before ...
2
votes
2answers
221 views

Keepass Dictionary Attack Protection Strategy

Though pretty interested, I'm everything but an expert in Information Security, please redirect me to any helpful resources if my question is stupid or correct me if my assumptions are wrong. When ...
3
votes
4answers
369 views

True?: “Nearly all encrypted passwords are stored with the last character in clear text”?

[S]ome passwords are gleaned by hacking into computers where intruders can find stored passwords. Those are stored in encrypted form, but there's software that can attack the encryption. Nearly ...
0
votes
1answer
93 views

What kind of encoding/hash it is [closed]

I have email which is stored in Cookie : %2FGl%F8%7E%06%F1S%FEF%10%E0T%B3%95%82BK%D9%D3%94%BC%AE%E1 which is sth like this after convert it with this tool : ...
1
vote
1answer
118 views

Review of approach to client-side only hashing and encryption for web application

Background: I have little knowledge of hashing and encryption, so please bear with me. I have posted a related question here: ...
3
votes
2answers
177 views

How does my bank knows my second and forth chars of my password [duplicate]

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
0
votes
1answer
59 views

Is encryption less resistant to brute-forcing compared to hashing?

I understand that a hashing algorithm like bcrypt uses several rounds of hashing to make it computationally expensive for a brute-force attack. How does encryption work against a brute-force attack? I ...
0
votes
1answer
584 views

Hash the signing key of an authentication token in database

I have clients which are all browsers. All clients render just a single page application getting data from a Web API. The design of the API follows REST principles. I use token-based authentication ...
9
votes
1answer
195 views

Securing a prediction about a future event

I want to make a prediction about a future event, but only reveal that prediction after the event occurs lest knowledge of my prediction affect the outcome. For example, suppose Alice predicts that ...
3
votes
1answer
655 views

Best practice for data security on a web application

I read a couple articles on privacy/security but still cannot get a clear picture of the best practice to ensure that an attacker will not be able to access users' private information. For storing ...
-1
votes
2answers
198 views

Is AES feasible for secure hashing files? [closed]

There was already a similar topic "Why AES is not used for secure hashing, instead of SHA-x?", but it was not about files specifically, and I, personally, am not convinced by the answers in it. "AES ...
0
votes
1answer
89 views

Using multiple hash-functions along the line [duplicate]

I was wondering what the effect on strength/security is If I would use an aggregate of multiple hash-functions. For instance, I don't want to sent passwords in plain text (although it's over an ...
-3
votes
1answer
96 views

What is this encrypted with or where can I find examples of encryptions to compare it with? [closed]

I have a hash thingy I am trying to decode and I have done relatively little with encryption, though I would like to try to learn some more. The hash is: 1YMTpavsFq7ykllC3CCsg3e1li31re1nROxuW1wqIqpk ...
3
votes
2answers
152 views

Using public key infrastructure or hashing for personal identification privacy?

I've been reading about identity theft recently, and I'm wondering about some possible solutions using the techniques of asymmetric/symmetric/hashing in encryption. My idea is going to cross those 3 ...
0
votes
0answers
65 views

Does the ordering of encryption and hashing matter? [duplicate]

I am now learning keyed hash function, where A and B share a secret key k. I want to know if the ordering of encryption E and hashing H matters? i.e. Is there any difference between H ◦ Ek (m) and Ek ...
7
votes
6answers
841 views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
4
votes
3answers
1k views

symetric key encryption vs hashing

This is a fascinating document: top 100 passwords from adobe breach I have a question about one part of it: However, thanks to Adobe choosing symmetric key encryption over hashing, selecting ...
8
votes
4answers
671 views

At what point does adding more iterations to PBKDF2 provide no extra security?

If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an ...
1
vote
2answers
172 views

Would multiple exposed bcrypt hashes of the same UUID v4 with random generated salt be too insecure?

I'm looking into implementing an ownership check on JSON objects and want to avoid going back to the database to ensure ownership of said object/record (i.e., to prevent a user from updating an ...
0
votes
2answers
513 views

Does using Bcrypt to encrypt credit card numbers satisfy PCI compliance?

I understand that using MD5 is not safe and is not PCI compliant. Does using BCrypt satisfy PCI compliance
0
votes
2answers
550 views

Algorithm to generate NTLMv2 Hash in PHP

I am trying to develop a PHP function to calculate NTLMv2 hash by providing server & client challenge, domain, account and password. The resulting hash appears to be not correct. Can someone ...
0
votes
3answers
173 views

Devising encryption schemes and protocols

I am wondering how encryption schemes are developed and why certain decisions are made. For example. I have seen a company hash a string with SHA1 and then RSA encrypt it. Why? I've also seen the ...
2
votes
1answer
236 views

Unknown encryption string [closed]

I'm trying to learn about encryption and decryption methods when I faced this string: {MD5}JfnnlDI7RTiF9RgfG2JNCw== MD5 is 16-byte string, so anyone know what type of encryption is this and why ...
7
votes
1answer
483 views

HKDF and key stretching

I thought that all key derivation functions would do a key stretching phase, by iterating some kind of process. But I can't see that process in HKDF. HKDF doesn't do key strengthening? If I have a ...
3
votes
2answers
106 views

How to ensure two messages are from the same party

I need to verify that two messages, that came over distinct channels, come from the same origin: without knowing anything about the origin beforehand the channels are one-way, only one message may ...
-1
votes
1answer
368 views

Properties for cryptographic hash functions (preimage, second preimage and collision resistant)

While studying computer security at university I have been asked this question: There are three desirable properties for cryptographic hash functions: Preimage resistant, Second preimage resistant, ...
0
votes
0answers
31 views

How can I determine the encryption used by knowing input and result? [duplicate]

Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
-4
votes
2answers
303 views

the Informix password crack

I get some hash like: username sowainformix salt 7307821250330563328 hashed_password HaHvvzanjp_lPZgHLu0KHquN.Q4t98EF48csXk1QTJs hash_type SHA-256 updated flags ...
-1
votes
3answers
205 views

Salting in encryption (rather than hashing)

I am aware of the benefits of adding a salt to values that are hashed using a one-way function. Is adding a salt to a value that is being encrypted (using symmetric encryption) considered to be good ...
11
votes
1answer
403 views

“Please Enter Nth Character” without HSM

This question has been asked a few times, but always in the format "How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?" And the ...