A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

3
votes
1answer
94 views

Can I safely and securely store hash(sessionId) in application logs?

I'm considering storing a hash of a user's session ID in our applications logs on each request. This would allow users sessions to be easily tracked back to actions in our logs. I understand that ...
3
votes
1answer
217 views

Securely storing passwords using PHP5

Starting note: After going through some articles and answers posted on SO related to storing secured passwords I'm still not sure whether my way of thinking is applicable to todays reality. I'm ...
3
votes
3answers
135 views

Authenticity of PDF document printed from Word

My MS Word Add-In generates PDF preview of DOCX file on client PC and uploads both files to server. I cannot generate PDF on server. Is there any way to make sure that the PDF is the printed version ...
3
votes
3answers
349 views

Are credit card number look ups more secure with a hash function than with a deterministic encryption algorithm?

I understand PCI DSS 3.0 allows hashes of cardnumbers to be stored separately from encrypted values, but I'm startled at the efficiency of tools like hashcat in discovering card numbers from hashed ...
3
votes
1answer
118 views

Feeding PBKDF2 to SRP verifier creation

There is an older game that solely uses UDP to communicate, and I wanted to add password authentication to the game to facilitate things like experience points and rankings. To this end, I decided to ...
3
votes
1answer
207 views

Windows system password hashed - see which hash is used

How can I know / see if my windows is using NTML, LM, NTML2 for its user account passwords? What is the standard today, in windows systems?
3
votes
2answers
178 views

Related-password hash security

Say we are given a strong cryptographic hash function hash(), a strong completely random password of 15 characters pass15, two single-character salt values salta, saltb. We compute the hashes hasha, ...
3
votes
1answer
196 views

using counter instead of salt for hashing

I'm developing own protocol for secure message exchanging. Each message contains the following fields: HMAC, time, salt, and message itself. HMAC is computed over all other fields using known secret ...
3
votes
1answer
5k views

Which part of the eapol packets contain WPA password Hash?

I have captured wifi traffic from a WPA network using Wireshark. I filtered the results for "eapol" packets and noted in the info column there are message type 3 and type 1. I believe this is two ...
3
votes
1answer
314 views

How to determine hashes/second in password cryptanalysis

I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt. I'd like to ...
3
votes
1answer
422 views

DPAPI offline attack by cracking windows password?

I'm thinking of using DPAPI to protect configuration file information in my program. After doing some reading on it, it looks like it uses the user's Windows password as part of the encryption ...
3
votes
4answers
1k views

How password hashing is useful in MITM attack?

Even though I read a lot about hashing and how passwords are protected, I am still confused about it. If passwords are hashed at client side, it will be useless because it can be sniffed and used by ...
3
votes
2answers
535 views

Security of GPG encryption with AES and MD5 if MD5 is broken

I have a file encrypted with gpg, using AES256 and MD5. Suppose that the MD5 hash function is broken, but not the AES cipher. Does that make it easy to crack decrypt the file?
3
votes
1answer
78 views

John the ripper is not identifying hashes

I'm attempting to use JTR against a password protected zip. I have created the hash file using:zip2john filename.zip > filename.hash and i get a successful output:file.txt is using AES encryption, ...
3
votes
2answers
177 views

Why does LastPass store password hashes on the server at all?

While reading about LastPass' breach, I was wondering why would LastPass store strengthened password hashes at all on the server side? Could they only store the AES encrypted data and when the user ...
3
votes
1answer
148 views

What's the weakness of keyed-MD5 for message authentication?

I've seen public web API's using keyed-MD5 to generate message authentication code rather than adopting the HMAC algorithm. People wouldn't just invent HMAC for fun, so it must have some advantages ...
3
votes
1answer
266 views

How does hashcat figure out the SHA CRYPT ROUNDS on a Linux password

A part of my /etc/login.defs file looks like this: ENCRYPT_METHOD SHA512 # Define the number of SHA rounds. # If not specified, the libc will choose the default number of rounds (5000). # The values ...
3
votes
1answer
93 views

Secure text document's fingerprint

The purpose is the same as with hashing: given set of confidential documents, I want to process them and store something secure like salted hashes/bcrypt. Later, when new document is given, I want to ...
3
votes
1answer
154 views

Is this symetric or asymetric encryption?

I’m at the beginning of my journey into the world of security. I am reading about the most fundamentals topics and I have encountered something unusual that has thrown me. The Conundrum: I have come ...
3
votes
1answer
181 views

How secure is Visual host key, and how is SHA2 converted into that representation?

SHA2 has 256 bits of possibilities. Visual host key seems to have the following upper and lowercase = 26*2 numbers and symbols = 20 Additional symbols = 22 Total 94 characters represented in ...
3
votes
1answer
210 views

How does Dropbox actually protect against sharing copyrighted content?

This TechCrunch article discusses how Dropbox uses hashing to check whether you're sharing copyrighted material "without actually looking at your stuff." Specifically, they offer the following ...
3
votes
2answers
192 views

Difference between Second Pre-image Resistance and Collision Resistance in Cryptographic Hash Functions

I am studying the subject from these notes. However it is not clear what is the difference between "Second Pre-image Resistance" and "Collision Resistance" properties of Cryptographic Hash Functions. ...
3
votes
1answer
1k views

How to check for presence of LM hashes in local SAM

To get rid of LM hashes in local SAM databases, one can rely on the famous NoLMHash domain GPO, which instructs clients not to store password hashes with the LM algorithm locally ("Do not store LAN ...
3
votes
1answer
189 views

Do I need a salt when hashing a randomly generated password?

I have passwords stored in my database that are very long, unique and generated by a CSPRNG. Do I need to use a salt before hashing them? My understanding is that usually you use a hash function in ...
3
votes
4answers
2k views

Can I brute-force a password hash even if I don't know the hash-algorithm used?

Can I brute-force a password hash even if I don't know the underlying algorithm? For example if I get hold of a database with password hashes and the used hash algorithm is unknown, like a random ...
3
votes
2answers
738 views

MySQL ENCRYPT salt is not random?

I know there's little reason to still use ENCRYPT() nowadays, what with bcrypt being almost ubiquitous and MySQL providing better hashes such as SHA1. But while dabbling with ENCRYPT() on MySQL ...
3
votes
2answers
272 views

Hashes of overlapping data - does it make them easier to crack even when neither is cracked

Say I have strings: stringA, StringB, stringC. And I make two hashes: HashA = sha256(stringA + stringB) HashB = sha256(stringB + stringC) For the sake of the argument I'm suggesting sha256 but ...
3
votes
1answer
137 views

Password hashing on a load balancing setup

I've been doing some research into password hashing implementations and would like to know if it's feasible to have two servers hash passwords to the same database? I've come across the Bcrypt.net ...
3
votes
2answers
2k views

Is there an index of all md5 collisions?

I am about to build a caching system based on md5 to generate file names out of lists of natural numbers. The inputs would be groups like: 1,18,94,100,266,1854. I know there are some collisions in ...
3
votes
1answer
295 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
3
votes
2answers
200 views

John the Ripper not identifying a password contained in the username?

I have uploaded a screenshot of what exactly is going on, here: http://i.imgur.com/bJSv7C8.png I can see that single-crack mode includes a rule that looks at the username, and "slices" it to identify ...
3
votes
1answer
100 views

Is it possible to slow down the Blue Midnight Wish cryptographic hash function?

In the Blue Midnight Wish (BMW) cryptographic hash function, is there a variable I can use to increase memory/CPU resource consumption to slow down the password hashing process? Call me crazy, but I ...
3
votes
1answer
308 views

Improving magnetic stripe card security with a “magnetic noise” hash?

I was reading the wiki on magnetic stripe cards when I stumbled across this sentence: "Magnetic stripe cloning can be detected by the implementation of magnetic card reader heads and firmware that can ...
3
votes
2answers
222 views

Using public key infrastructure or hashing for personal identification privacy?

I've been reading about identity theft recently, and I'm wondering about some possible solutions using the techniques of asymmetric/symmetric/hashing in encryption. My idea is going to cross those 3 ...
3
votes
2answers
388 views

Does glibc2 version of the crypt function still use DES for alternative hashing methods?

I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
3
votes
1answer
200 views

Are there any uses of having a non-deterministic salt value for hashes?

So I've been toying with the idea of having non-deterministic salt values for hashes. Let me explain what I mean: Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
3
votes
1answer
3k views

Parsing a PKCS7 detached signature hash

I'm trying to manually verify signatures of Apple iOS Passbook files, which are PKCS #7 detached signatures of the RSA key of the Apple developer who created the file. Which means there's a file ...
3
votes
1answer
217 views

How should I store a password to allow people to enter single characters from it? [duplicate]

Possible Duplicate: How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext? Some banking applications ask for random letters ...
3
votes
2answers
695 views

What algorithms can be used for device pairing?

I am to implement a system where android devices connect to a central server and have to register with different user accounts, so I have decided to create a pairing dance similar to what can be ...
3
votes
0answers
87 views

How far should I go in protecting a user's SMBIOS UUID?

My server will be receiving data from several hundreds of computers. As part of keeping track of which computer sent what, I will be fingerprinting the hardware and keeping the results in my database. ...
3
votes
5answers
428 views

A secure way to encrypt a connection between 2 clients securing against both passive and active adversaries

Recently I got interested in encryption and the methods behind them. So for a fun / school project I am building a program in python to encrypt data between two clients (chat and files). I'm just ...
3
votes
0answers
167 views

Login details security using salt and hash, and a login role in postgresql

I am coding up the security for a website in express.js and postgresql database. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but ...
3
votes
0answers
248 views

Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]

In my school everyone must change their password every six months. The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...
3
votes
0answers
285 views

Can an attacker guess my password length from a hash? [duplicate]

Possible Duplicate: Possible to detect password length from hash? Is doubling your password adds more security? Considering I do not provide him any personal information relating to it, are ...
3
votes
0answers
201 views

Checking whether a password is derived from previous passwords [duplicate]

Possible Duplicate: How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext? On a system I used several years ...
3
votes
0answers
182 views

Files for download and their hash numbers

I'm far from being an expert in the IT security and I have this maybe naive question. Many downloadable files are deployed on websites together with the corresponding hash numbers to ensure their ...
3
votes
1answer
146 views

A pair of 'self-signing' hashing functions? [closed]

Does a pair of (hashing) functions for which where neither g(x) nor f(x) are constants exists?
2
votes
4answers
848 views

Using last characters of hash as salt [duplicate]

In a recent discussion somebody mentioned the following hashing scheme: passHash = sha256(password) saltedHash = sha256(passHash+passHash.substr(-10) finalHash = sha256(secret+saltedHash) The ...
2
votes
3answers
658 views

Storing passwords on a home computer

I remember all the passwords (and variations of passwords) that I use for various sites online. The problem is not that I forget a password, but that I forget which password goes with which site. And ...
2
votes
4answers
292 views

Why is a password accompanied by a username deemed 'safer'?

While browsing this community I notice that some people say that the main advantage of usernames accompanied by passwords is as they take more tries to be brute forced, however I don't think that is ...