A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

3
votes
6answers
333 views

Is it okay to wrap a cryptographic hash with MD5 for storage?

Is there any security issues if you wrap your cryptographic hash with MD5 for storage purposes? For example: $hash = md5(hash($password,$salt,$rounds)); Note: hash() uses scrypt or bcrypt or pbkdf2 ...
3
votes
2answers
467 views

Is the password hash better when you concatenate the password and username?

Is the password hash (with bcrypt) better when You concatenate the username with password? For example: $this->hash($username . $password); and $this->hash($password); Last time I used ...
3
votes
3answers
597 views

What pros and cons are there to a one-time random salt between client and server?

In researching on best practices in hashing passwords using a salt I came across a presentation on slideshare. The approach outlined is as follows Client requests login page Server-side code ...
3
votes
2answers
593 views

Why is the diffusion property important in hash functions

I have always heard that A change in just one bit of the original text shall change half of the bits of its hash. I think this property is called the diffusion property. However, I wonder why ...
3
votes
1answer
1k views

How to apply FIPS to Microsoft Access database with custom VBA

As the software engineer on a project, I have been asked to make a Microsoft Access application, with custom interfaces running custom VBA. That part is going just fine. Recently though I was asked to ...
3
votes
1answer
154 views

MD5 Algorithm: A basic explanation of the process

Could anyone please explain the basic idea and steps involved in the MD5 algorithm? I tried reading it on the web (Wikipedia etc.), but it was just too high level for me. So, can someone explain the ...
3
votes
2answers
194 views

How to give “Forgot password” option for a password encrypted file?

I have created a utility that encrypts a file (.txt, .dox, so on...). The utility asks for a password from user at the time of file encryption. Problem Suppose a user has created 1000 encrypted ...
3
votes
2answers
9k views

NTLM/LM Hashes on Domain Controller

I've noticed that when extracting password hashes from a domain controller (using Elcomsoft proactive password auditor) sometimes I'll get LM and NTLM hashes and other times I'll only get NTLM hashes. ...
3
votes
2answers
2k views

What does GUID have, that a Whirlpool, MD5 or SHA-2 hash don't?

I'm trying to understand the use of GUID and what has always left me wondering is what's so special about them that I should consider using them instead of rolling my own type of unique ID. In other ...
3
votes
1answer
2k views

Key length and hash function in PBKDF2

On this page: http://www.ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL/PKCS5.html they make a statement that strikes me as rather weird: Key Length Specifies the length in bytes of ...
3
votes
1answer
318 views

Can a salted hash be an effective MAC?

An HMAC is basically a "keyed hash". Only the correct message and the correct key will produce a particular hash digest efficiently. Conceptually speaking, the same can be said for a salted hash; ...
3
votes
2answers
487 views

What's the point of using multiple checksum algorithm with “aide”?

In aide the author offers more than one hash algorithm to do the check-sum, why is that? Aren't a single one, i.e sha512 enough for determining file changes? I believe these algorithms are all ...
3
votes
5answers
608 views

PCI-DSS and salt storage

PCI-DSS states the following: 3.5 Protect any keys used to secure cardholder data against disclosure and misuse I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...
3
votes
3answers
335 views

Does the hash change the security of the Secure Remote Password protocol?

I'm implementing the Secure Remote Password protocol, and similar to this question, I'm wondering if I can use the SHA-512 hash function instead of SHA-1 currently being used. Would this help improve ...
3
votes
1answer
153 views

What are the implications of omitting the username in Secure Remote Password's verifier?

I consider implementing a Secure Remote Password (SRP-6a) verifier that omits the username from the x key hash. The intention is to allow authentication with multiple alternate user identifiers such ...
3
votes
2answers
568 views

BlackBerry client authenticating to Java Web Service

I already asked this question at StackOverflow here: http://stackoverflow.com/questions/4970681/blackberry-app-security and was directed to this site, can anyone pitch in as to how I can solve this ...
3
votes
2answers
55 views

Incrementing Work-Factor of Hash Functions Over Time

For a long time hash functions have required a work-factor in order to keep the operation "slow" enough to protect individual passwords in the case of a database leak. Bcrypt and PBKDF2 being notable ...
3
votes
2answers
131 views

Are there any known MD5 hash collisions of messages of different length?

All the examples of MD5 hash collisions I've come across comprise two different messages (inputs) of the same length. The first and second messages have different values for a number of bits and the ...
3
votes
1answer
67 views

Does salt increase security if there is only a single hashed password?

Say there is only a single hashed password in the passwords file. If it was salted, would that make it more secure? My logic is: Yes because SALT helps protect against rainbow tables and dictionary ...
3
votes
3answers
247 views

Question regarding MAC and encryption

I was reading the chosen answer to the following question - "MAC vs Encryption" They say that just using encryption, "an attacker could alter the ciphertext to make it say something else when ...
3
votes
1answer
183 views

“MAC function must resist existential forgery under chosen-plaintext attacks”, what does that mean?

While reading about MAC (Message Authentication Code) I have faced this sentence: MAC function must resist existential forgery under chosen-plaintext attacks but I got confused. What does ...
3
votes
2answers
163 views

Is there any reason for using private key 2 times when creating security hash?

One of the payment solutions for the websites provides the following way of creating security hash for payment link: hash = sha1(private_key + payment_params_json + private_key); Is there any ...
3
votes
1answer
387 views

John the Ripper missing formats [closed]

I have an sha256 hash that I am trying to crack with John the Ripper. However, it doesn't recognize raw-sha256, raw-md5, or any hash format other than descrypt, bsdicrypt, md5crypt, bcrypt, LM, AFS, ...
3
votes
2answers
254 views

Is it unsafe to have hashes of parts of a private string

We have string B and the hashes hash(P+B), hash(P); is it possible for P to be revealed easier using this information than having hash(P) ? What is the difference ? Any links to articles or any ...
3
votes
2answers
710 views

Why use PBKDF2 over multiple iterations of a another cryptographic hash function?

People often recommend PBKDF2 over using hash functions directly, but typically they compare PBKDF2 to a single unsalted hash. What advatages are there to using PBKDF2 over multiple iterations of a ...
3
votes
2answers
248 views

How does my bank knows my second and forth chars of my password [duplicate]

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
3
votes
2answers
2k views

Finding out whether a website uses unsalted MD5 for password hashing

I'm working on a project where websites are analyzed and rated according to password security (factors like min/max password length, alphabet size and more are then calculated into a score). A great ...
3
votes
2answers
115 views

How to ensure two messages are from the same party

I need to verify that two messages, that came over distinct channels, come from the same origin: without knowing anything about the origin beforehand the channels are one-way, only one message may ...
3
votes
3answers
1k views

Why are MD5 collisions dangerous?

I understand that the MD5 algorithm isn't collision resistant, and that collisions between data of arbitrary size can be found with more efficient methods than brute-forcing. However, I have read ...
3
votes
2answers
400 views

Fixing the high-bit problem in PHP's crypt() implementation

I'm working on a site that has to have compatibility with older versions of PHP, which suffer from a high-bit issue in the Blowfish crypt() implementation. Essentially, non-ASCII characters are not ...
3
votes
1answer
495 views

How big is the risk of hash fixed points/cycles?

It's established wisdom to hash password multiple times with a salt to increase the time it takes per brute force iteration. At the same time (unless the algorithm guarantees otherwise) there's a ...
3
votes
1answer
379 views

Is there a better way to take advantage of current 'approved', 'proven', and memory/cpu-expensive algorithms while using salts and peppers?

I've read about the concepts presented in these two questions: Pre-hash password before applying bcrypt to avoid restricting password length Would it make sense to use Bcrypt and PBKDF2 together? I ...
3
votes
3answers
185 views

How to know if its the same User?

I asked a question awhile ago asking how to make an efficient encrypted chatroom. What I ended up doing was Making each user generate a 4096 bit RSA KeyPair, share their public Keys, and then one of ...
3
votes
2answers
685 views

Implementing brute force attacks on hash values in Javascript

I'm working for my bachelor thesis at the end of which I aim to implement a proof-of-concept Javascript-based hash cracker. The idea is to work like this: Users can submit a hash value along with ...
3
votes
4answers
571 views

Hash/Digest of string; multiple clients and reverse lookup must be impossible

Ok so i need a technique (could be a system or just an algorithm) to generate a hash/digest of a string on a client app without me (admin of a server app) being able to determine what the original ...
3
votes
1answer
96 views

Can I generate a random 32 bit key by using the Java hashCode and random English words?

I want to generate and communicate a 32 bit key to Bob over a phone conversation. I know he happens to have the same Java and OS installed as I have. Suppose I have a dictionary of 100,000 (English) ...
3
votes
1answer
156 views

Best way to hash passwords in PHP 5.3.5

What is the best way to hash passwords in PHP 5.3.5? Since in this version doesn't have password_hash().
3
votes
2answers
72 views

Is hashing schema information for client when generating SQL queries more secure?

I'm planning to implement a web system wherein APIs and presentation for CRUD in data tables are automatically generated, like that in phpMyAdmin. How I plan to implement this is to construct SQL ...
3
votes
1answer
369 views

Truncating hash output for a unique ID

This seems like a common question, but my knowledge on hashing is very limited, so I'm looking for a more ELI5-type answer. I would appreciate if someone could help me with my questions Some context:...
3
votes
1answer
615 views

PBKDF2 strong salt for client-side hashing

What should I use as a secure/strong salt for PBKDF2 hashing when salt is not available to use before login as it will be client-side javascript to hash user+pass with PBKDF2 ? I'm going to use sha(...
3
votes
2answers
3k views

TrueCrypt VS LUKS Bruteforce Resilience

I have been researching LUKS vs TrueCrypt topics -- my only concern is security, but most of the discussions I see focus around usability / interoperability . I know TrueCrypt has a bunch of nice ...
3
votes
1answer
214 views

How to best to secure data over HTTPS

My aim is to have an (iOS) app in which the user would login, then on sucsessful login, gain access to additional information over an encrypted webservice (undecided). From research, I understanding ...
3
votes
3answers
276 views

Is it ever safe to publish hashed data?

I'm having a friendly debate with someone who thinks that a website can safely make public sensitive data about it's users as long as that data is hashed (don't ask why, it's a long and hypothetical ...
3
votes
2answers
1k views

How secure is the PwdHash algorithm and system?

I use the PwdHash service (http://crypto.stanford.edu/PwdHash/) and plugins for pretty much all of my passwords. I believe this is safer because: No service gets the same password as another, so if ...
3
votes
1answer
2k views

I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? How to store salt? Ok I have been studying a lot about password hashing lately. And I have a few questions. So I ...
3
votes
1answer
579 views

Cookie based session variables

I have a situation in which I cannot use a server-side session, but must allow users to log in, and for their logged in state to be persistent between queries. As with anything that involves crypto ...
3
votes
1answer
164 views

How to detect mimikatz usage on LAN

My boss is has made it clear that we need better ways of detecting mimikatz usage on the network- and I would agree. In place already for detection is suricata/ET PRO rule set on a couple of taps. ...
3
votes
2answers
182 views

Is signing android apk file with SHA1 digest secure enough?

Google command line example for signing apk files: $ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name source: http://developer....
3
votes
1answer
95 views

What fuzzy hashing algorithms exist?

I have been trying to find information on fuzzy hashes, and I have found surprisingly little. I know that fuzzy hashes can be used to detect if a piece of malware has changed slightly. I would rather ...
3
votes
2answers
107 views

Use password to calculate checksum for API requests

I was wondering if it would be an effective way of securing an API by requiring all requests to be checksummed, salted with the users password (or a hashed version)? With securing I mean making it "...