A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

4
votes
2answers
4k views

Rounds of MD5 and SHA512 Hashing Algorithms

What is the exact number of rounds employed by the MD5 and SHA512 hashing algorithms? According to various sources, the SHA512 hashing algorithm employs a total of 80 rounds (http://en.wikipedia.org/...
5
votes
2answers
209 views

What is the meaning of the term “simple string” for the SALT string in Unix crypt using SHA-256 and SHA-512?

In Unix crypt using SHA-256 and SHA-512 the author, Ulrich Drepper, introduces the SALT string as the following (highlight by me): For the SHA-based methods the SALT string can be a simple string ...
6
votes
5answers
981 views

Is it a good idea to use an input by the user as SALT?

I have read many Q&As here on IT Security about password hashing and salting. I am building a simple registration form for our community website which will be used by our members to create their ...
1
vote
1answer
403 views

Generate Keytool Object from CSR

I have to develop an application which uses another application for generating a CSR. After generating the CSR I have to provide this CSR along with a SHA256 hash of the public key to a CA. The ...
0
votes
1answer
751 views

What does it mean by the 'Hash of a malware'?

I have just recently started to delve into the topics of malware. In my hunt for malware binaries, I came across certain responses that it is not easy to grab binaries based on malware names like ...
1
vote
1answer
2k views

How do I generate a blowfish password hash in Ubuntu?

What's the command line to generate a blowfish password hash? I can't seem to figure this out at all. Apache's htpasswd only supports bcrypt, and openssl passwd doesn't even do blowfish hahes (but it ...
10
votes
3answers
8k views

How exactly is MD5 vulnerable to collission attacks?

I've often read that MD5 (among other hashing algorithms) is vulnerable to collisions attacks. I understand the collision part: there exist two (or more) inputs such that MD5 will generate the same ...
-1
votes
2answers
14k views

How to get an NT hash from registry? [closed]

I want to manually get the NT hash from the registry (without any tool). Let's say just for the administrator. I know that it must be stored in the SAM area of the registry somewhere so I tried to ...
2
votes
3answers
2k views

Reversing Password Hashes [duplicate]

if someone got hold of the hashes of all passwords for a website, how do they 1) get passwords from the hashes. As far as I can tell from searching the internet everything seems to say do a dictionary ...
9
votes
1answer
2k views

HKDF and key stretching

I thought that all key derivation functions would do a key stretching phase, by iterating some kind of process. But I can't see that process in HKDF. HKDF doesn't do key strengthening? If I have a ...
2
votes
5answers
412 views

Methods used to reverse a hash

I know that a hash is a one-way-function and that therefore there isn't a reversal function. By reversing a hash I just mean to find some plaintext that gives the hash. I think that I understand that ...
0
votes
2answers
16k views

If hashing is one way, why can we decrypt MD5 hashes?

I have read some times that hashing is a one way function, that is you can make the hash of a message, but you can't recover the original message from the hash, just check its integrity. However, if ...
2
votes
1answer
3k views

What are realistic rates for brute force hashing?

I'm trying to gauge password strength assuming that the attacker has a hash of my password. Can anyone cite some realistic contemporary rates at which someone could perform various hashes? I know most ...
2
votes
3answers
688 views

Storing passwords on a home computer

I remember all the passwords (and variations of passwords) that I use for various sites online. The problem is not that I forget a password, but that I forget which password goes with which site. And ...
3
votes
2answers
115 views

How to ensure two messages are from the same party

I need to verify that two messages, that came over distinct channels, come from the same origin: without knowing anything about the origin beforehand the channels are one-way, only one message may ...
10
votes
2answers
18k views

Safety of publishing last 4 credit card digits in age of fast computing?

How safe is it to make public the last four digits of a credit card? Credit card numbers have a specific format. Digits tell you what type of institution issued the card, what bank issued the card, ...
-1
votes
1answer
532 views

After salting my passwords, are they protected against dictionary attacks? [duplicate]

I use sha1() to hash my users passwords, but recently a friend told me that if someone get the hash then they could use dictionary attack and he recommended using salts. I implemented a random salt ...
3
votes
3answers
1k views

Why are MD5 collisions dangerous?

I understand that the MD5 algorithm isn't collision resistant, and that collisions between data of arbitrary size can be found with more efficient methods than brute-forcing. However, I have read ...
10
votes
4answers
1k views

Does hashing a PRNG make it cryptographically secure?

Would hashing the result of a regular random number generator produce a cryptographically secure PRNG? For example, would sha1(rand()) effectively be a secure PRNG? Assuming it doesn't, how would ...
2
votes
3answers
180 views

User specified iteration count

I'm working on a PHP authentication and registration system following the standard salt+password = 'auth hash' and using the plaintext/unencrypted username as the lookup field on the initial query. ...
5
votes
2answers
569 views

Why is 8ms a goal for hashing?

I'm currently developing a small project in PHP, and as it involves user authentication, I've been researching what options I've got regarding hashing. I've settled on PBKDF2 primarily due to it's ...
3
votes
0answers
248 views

Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]

In my school everyone must change their password every six months. The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...
0
votes
2answers
2k views

Why store the password salt instead of generating it? [duplicate]

So, reading through this article: http://crackstation.net/hashing-security.htm it says that storing the salt is fine in plain text because it renders the lookup/rainbow tables ineffective. I get that, ...
20
votes
8answers
3k views

Why should I hash passwords?

I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it? When a ...
-1
votes
1answer
846 views

Properties for cryptographic hash functions (preimage, second preimage and collision resistant)

While studying computer security at university I have been asked this question: There are three desirable properties for cryptographic hash functions: Preimage resistant, Second preimage resistant, ...
0
votes
0answers
38 views

How can I determine the encryption used by knowing input and result? [duplicate]

Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
-6
votes
2answers
509 views

the Informix password crack

I get some hash like: username sowainformix salt 7307821250330563328 hashed_password HaHvvzanjp_lPZgHLu0KHquN.Q4t98EF48csXk1QTJs hash_type SHA-256 updated flags ...
7
votes
2answers
2k views

Does the md5 (or any hash for that matter) of a string include the null terminator?

Does the md5 (or any hash for that matter) of a string include the null terminator in its calculations? That is does the hash of a string equal the hash of the sequence of bytes that represents the ...
9
votes
2answers
3k views

“Official statement” on php.net : CRYPT_BLOWFISH is strongest hash algorithm. Why?

First: I asked this question on stackoverflow and was kindly asked to post this here again. See the original question here. According to the [early] doc pages of the new PHP 5.5 password hashing/...
5
votes
2answers
1k views

Do SSD's offer significant performance boost for Scrypt?

Being a memory intensive hash, I was wondering if SSD's offer any appreciable performance boost for brute force attacks.
2
votes
2answers
429 views

Does glibc2 version of the crypt function still use DES for alternative hashing methods?

I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
-1
votes
3answers
270 views

Salting in encryption (rather than hashing)

I am aware of the benefits of adding a salt to values that are hashed using a one-way function. Is adding a salt to a value that is being encrypted (using symmetric encryption) considered to be good ...
3
votes
4answers
582 views

When salting and hashing passwords, any advantage to including password length?

In this answer, Gilles says (emphasis mine): There's no need to hide the salt from the attacker: it needs to be unique (and not derived from the password) but it doesn't need to be more secret ...
35
votes
7answers
11k views

Is salting a hash really as secure as common knowledge implies?

(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.) I'm implementing a salt function for user passwords ...
2
votes
1answer
1k views

What is the collision chance of a 128-bit hashing function if it is always fed with 256-bits of data?

I mean "normal" collisions not based on any attack. How do i calculate it?
5
votes
1answer
197 views

Could a password hash that's prone to more collisions provide better overall security?

Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
10
votes
4answers
8k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
6
votes
1answer
336 views

Is the execution time for bcrypt independent of the length of the input string?

Is the execution time for bcrypt independent of the length of the input string? i.e. Should the execution time of bcrypt.hashpw('input_string', bcrypt.gensalt(12)) and bcrypt.hashpw('...
1
vote
1answer
2k views

How secure is my private key in the Windows Digital Certificate store?

Many files we download don't have digital signatures. Files may get infected or someone may intentionally modify them on our hard disk. So I wrote a simple file hashing program in c# that creates a ...
1
vote
3answers
1k views

Why one time passwords using nested hash chain are not used?

I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
1
vote
2answers
138 views

Does hash solve passwords in parts?

From an answer this earlier question: Does adding dictionary words to passwords weaken them? "...you have no way to recognize it as a password before testing it (against a hash or an online ...
3
votes
1answer
229 views

Are there any uses of having a non-deterministic salt value for hashes?

So I've been toying with the idea of having non-deterministic salt values for hashes. Let me explain what I mean: Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
2
votes
1answer
620 views

Hash extension(padding) attack

I recently came across this website talking about sha1 padding attack. http://www.vnsecurity.net/2010/03/codegate_challenge15_sha1_padding_attack/ After reading here are some of my doubts: How ...
3
votes
1answer
322 views

How to determine hashes/second in password cryptanalysis

I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt. I'd like to ...
8
votes
2answers
3k views

Truncating the output of SHA256 to 128 bits

suppose we need/prefer 128 bit hash output. for example to generate a 128 bit encryption key or, in other applications (e.g. file integrity verifications), to consume less storage space. i don't know ...
11
votes
1answer
563 views

“Please Enter Nth Character” without HSM

This question has been asked a few times, but always in the format "How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?" And the ...
0
votes
4answers
214 views

multiple hash values in a single malware file

Can a malware file have multiple "Hash values"?
7
votes
3answers
794 views

Is Using MD5 Sufficient Reason to Reject This Payment Processor?

I'm evaluating a credit card processor[1], and I noticed they are using MD5 as part of a salted hash algorithm to protect a secret key. Since I know MD5 is generally considered broken, this feels like ...
12
votes
3answers
13k views

With ASIC bitcoin miners, should SHA256 be considered insecure for password hashing?

I'm sure everyone here has seen the rise and further rise of bitcoin. The process used for mining bitcoin is basically "let's brute force an SHA256 hash that is less than this amount" That being ...
3
votes
2answers
2k views

What does GUID have, that a Whirlpool, MD5 or SHA-2 hash don't?

I'm trying to understand the use of GUID and what has always left me wondering is what's so special about them that I should consider using them instead of rolling my own type of unique ID. In other ...