A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

2
votes
1answer
114 views

Securely store two values per user in SQL

I have come across the need in my web app to store two values for each user. These values would need to be retrievable from a value stored in a URL. I would prefer to store neither of the values in ...
2
votes
1answer
275 views

Legality and ethics of cryptanalysis on password hashes

I'm working on my dissertation concerning cryptanalysis on password hashes. I'd like to delve into the legal and ethical aspects of cryptanalysis, however, seeing as I'n not at all well versed in law ...
2
votes
1answer
93 views

What is the purpose of the hashcode used in Exchange OWA HTTP requests?

This blog describes the URLs that are used in OWA and webservices. It also says that there is a hashcode that is used in conjunction with the throttling policy. Is this hashcode responsible for ...
2
votes
3answers
1k views

Preventing dictionary attacks against hashed passwords [duplicate]

Possible Duplicate: How to securely hash passwords? I have a website and on that website I use SHA-256 and salt my user's passwords. What I'm doing right now is padding each letter of the ...
2
votes
2answers
78 views

Randomness of hash token in password reset link [duplicate]

I want to know what are the points to be kept in mind while creating a hash token for my password reset links. In particular, how to make it un-predictable for an attacker?
2
votes
1answer
44 views

PBKDF2 strong salt for client-side hashing

What should I use as a secure/strong salt for PBKDF2 hashing when salt is not available to use before login as it will be client-side javascript to hash user+pass with PBKDF2 ? I'm going to use ...
2
votes
2answers
115 views

Difference between Second Pre-image Resistance and Collision Resistance in Cryptographic Hash Functions

I am studying the subject from these notes. However it is not clear what is the difference between "Second Pre-image Resistance" and "Collision Resistance" properties of Cryptographic Hash Functions. ...
2
votes
1answer
75 views

Security of shared “super pin” code table at meineschufa.de

The german brank credit report service "Schufa" uses a so called "SuperPIN" to enable users to reset their password. This super pin is a permutation of 30 lower and upper case letters and digits and ...
2
votes
1answer
215 views

HMAC secret key for securing communication - how to keep private on DB

I have a mobile app that communicates to server over HTTPS. To authenticate the client and to make sure its who I believe it is, I return upon successful signup (apart from the username) a secret API ...
2
votes
1answer
169 views

Is encrypting something more than once safer than hashing more than once?

I am aware of the implications that hashing something more than once correctly will increase the security of a system, but doing it incorrectly will decrease it, as noted here and on various other ...
2
votes
2answers
118 views

Breach informing

I am a staff member of a large fanfic site, but not the head administrator with control over the site itself. Recently, we had a security breach and the databases were copied, which included the ...
2
votes
1answer
360 views

FIPS 140-2 C# Password Hash

Is the following algorithm, using RNGCryptoServiceProvider & Rfc2898DeriveBytes, sufficient to implement a FIPS 140-2 password hash on Windows Server 2008R2? var provider = new ...
2
votes
2answers
218 views

Locality Sensitive Hash (LSH) function to approximately match old passwords

Recently, I ran across a website that requires me to change my password after X number of days had passed since I had last created one. Intelligently, the service made sure that the password did not ...
2
votes
1answer
63 views

Parameters in output of password hashing function

A number of encryption functions include their tuning parameters in the output. For example, SCrypt, which I've been considering for an app I'm building, outputs in the following format: ...
2
votes
1answer
863 views

sha-512 vs sha-3? [duplicate]

Does the new SHA-3 Keccak hashing algorithm offer any benefits from SHA-512? "Even worse, none of the SHA-3 candidates is significantly better. When SHA-3 is announced, I'm going to recommend that, ...
2
votes
1answer
668 views

Loki How to crack the password hash OSPF?

I have created for myself a lab of routers in GNS3 . Routing protocol between routers is OSPF. Now,by Loki penetration testing, I found that routers are the feature authentication. Using wireshark, I ...
2
votes
0answers
62 views

Using hash for one time pad key [migrated]

Recently I've been delving into security algorithms, I already knew some of the (easy) math behind AES and RSA and how to and not to implement it. But well, i got a bit bored so i thought I'd just do ...
2
votes
1answer
89 views

RESTful web application security and authentication scheme

I am building a web application where the front-end is a single-page-app and the back-end serves it through a RESTful API. I want to make sure I implement user authentication with the best security ...
2
votes
2answers
103 views

A secure way to encrypt a connection between 2 clients securing against both passive and active adversaries

Recently I got interested in encryption and the methods behind them. So for a fun / school project I am building a program in python to encrypt data between two clients (chat and files). I'm just ...
2
votes
0answers
42 views

HMAC-SHA256 Transaction signing [closed]

Can rfc6238 be used for transaction signing by concatenating the random seed string with transaction details (such as amount and target account number) ? Could a transaction authorization 8-cipher OTP ...
2
votes
2answers
433 views

Tracking IP address to prevent abuse without logging user metadata

I am trying to balance good security practices against excessive logging of user metadata / Personally Identifiable Information. I am constructing a web app that allows for secure messaging. In part ...
2
votes
1answer
150 views

Stream/Block encryption using XOR and Hash function?

Could a hash function like sha1 or ripemd-160 be used for secure key generation in a stream/block cipher? Obviously a repeated key like "abc123abc123abc123" would be bad, and a one time key pad would ...
2
votes
1answer
305 views

ASIC/FPGA hardwares to compute Scrypt hashes [closed]

this company claim Scrypt mining by ASIC (on crypto currencies who use scrypt hashing as proof of work) scrypt is made to keep ASIC/FPGA attackers away, is that claim expired?
2
votes
1answer
344 views

Legality of downloading leaked hashes / attempt cracking [closed]

Note: I realize there is no legally binding talk hereinafter. There are lots of leaked password hashes on the internet. Twitter searches for "hash dump" pull back tons of links, generally from "deep ...
2
votes
0answers
313 views

How do I convert from this weird John/Asleap format to lc (for HashCat)?

I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
2
votes
1answer
1k views

How to save the random salt to the database

As I understand it, salting and hashing passwords is the way to go. I also understand that to authenticate a salted and hashed password, the random salt needs to be saved. Does this mean that if I use ...
2
votes
1answer
206 views

Seeding GPG keygen with a hashed secret [duplicate]

Possible Duplicate: Tool for public key cryptography where password is the private key? I was wondering if you guys could clue me in to potential problems with using a hashed password as ...
2
votes
3answers
340 views

Password Security: Encrypting salt [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? I'm new to security and trying to understand why encrypting or hiding a salt is not considered useful. I've read ...
2
votes
2answers
1k views

Is there an index of all md5 collisions?

I am about to build a caching system based on md5 to generate file names out of lists of natural numbers. The inputs would be groups like: 1,18,94,100,266,1854. I know there are some collisions in ...
1
vote
4answers
434 views

Are there vunerabilities with this authentication mechanism?

I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire. I was ...
1
vote
1answer
585 views

Is this password hashing + salt method the most secure way possible? [duplicate]

I am just wondering what all the security experts think of my method for password hashing. I want to come up with a method I can use for all my future web development projects. First I create a ...
1
vote
6answers
1k views

Is SHA-1 encryption?

I have read that SHA-1 is a cryptographic hash function. On an exam, SHA-1 was given as a possible one-way encryption algorithm. Does SHA-1 require a key as input? Is a key required to qualify as ...
1
vote
5answers
1k views

making an iPhone/Android app which sends a user password to my server, how to secure?

I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login. I don't have SSL on my website, but it's just a reviews website and ...
1
vote
4answers
363 views

Should BCRYPT be used for client-side password hashing

I am concerned about the use of bcrypt for client-side password generation. I am developing a password generation function to be used client-side, similar to PwdHash and PasswordMaker. Much has been ...
1
vote
2answers
367 views

Are newly-generated recovery passwords sent to me via email hashed? [duplicate]

If a company sends me a new password via SMS/email because I clicked "forgot my password." Does that mean the company is not actually hashing my passwords?
1
vote
2answers
1k views

Reversible Hash Function?

Is there any reversible hash function? The hash function like SHA and MD5 are not reversible. I would like to know if there exist some reversible hash functions?
1
vote
1answer
372 views

Use brute force to mitigate brute force

Just an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information. My idea is this... When storing a password in ...
1
vote
4answers
2k views

Antivirus Engine based MD5 or SHA1 hash?

I'm trying to understand more about MD5 and SHA1 hashes algorithms and their behavior in serious security software(found this but not helped me more). Why does ClamAV use additional scanning ...
1
vote
4answers
317 views

Is it possible to know the key if we have the original value and the hash using HmacSHA1?

I was wondering if it were possible to know the key if you already know the original value and the hashed result. For example, let's say : `$value` = helloworld `$hmac_key` = 0123456789 `$result` = ...
1
vote
3answers
918 views

What is the correct way to make a password salt?

I've made the below function to make a completely random 64 character long hash function password_salt($password){ $salt = hash("sha512", mt_rand(1,100000) . strtotime("now") . $password . ...
1
vote
1answer
162 views

Theoretical home grown password options, or what is it that SCrypt, BCrypt, PBKDF2 does that is so special?

I'm developing a personal web framework, nothing internetty, and probably not even anything that will ever go on my personal LAN. And looking for password advice people seem to only recommend those ...
1
vote
2answers
200 views

Hashed Database: Hash Functions

Let's assume there is a database containing names and each name is hashed and the clear-text is deleted. If an attacker were to steal this database, would he/she be able to get the list of names?
1
vote
3answers
604 views

Password Security and ocl-Hashcat-plus

I recently read the Ars Technical Article about new features in ocl-Hashcat-plus. In light of questions like: Long Passwords: How are they more secure? and XKCD #936: Short complex password, or ...
1
vote
2answers
119 views

Is bruteforcing the last character of a salt a good idea?

Would it be a good idea security-wise to store salts with their last character removed, and then bruteforce the last character to further the amount of time it would take to create rainbow tables and ...
1
vote
2answers
83 views

Storing AES password for verification

I was wondering if such practice would be safe: I have a table that stores encrypted notes Every note has a data field and a password field When a password is entered, i want to select all notes, ...
1
vote
2answers
160 views

Stream/block cipher add a simple hash to guarantee integrity

The question is simple: Adding a hash to a message and then encrypt it using a stream cipher / block cipher. Why can't this guarantee integrity of the message upon decryption?
1
vote
2answers
169 views

Difference between OS X md5 and gnu md5sum

I have installed the "md5sum" utility on my Mac and there was also a "md5" binary pre-installed in /sbin. My problem and question is this: "Isn't MD5 a standard algorithm?" Because I get different ...
1
vote
4answers
208 views

Hashing Email Address and Contacting User

I am thinking about a log-in web service that would store a users username, password, and (optional) email address. If they forget their username or password, they can have their username and a ...
1
vote
2answers
138 views

Using “Dynamic Hash Technique” to protect cookies from XSS?

This paper appears to describe a solution in which XSS attacks stealing cookies are made pointless by having the server send clients a cookie with a hashed name. Whenever the user sends the cookie ...
1
vote
2answers
396 views

On what layer should password hashing and/or encryption take place

I'm finding myself on the inexperienced end of a discussion about where password hashing takes place. My coworker drew a schema from less to more secure, where the Public Internet was the least ...