A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

-1
votes
2answers
78 views

Website says my new password can't be used because it is the same as an old one [duplicate]

What are the risks of storing (in hashes I guess) all the old passwords? Why would a company chose to not delete old passwords? Why not let users reuse old passwords?
125
votes
6answers
47k views

Password Hashing add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
7
votes
2answers
164 views

Is there any recommended approach for “upgrading” MD5 hashes to something secure? [duplicate]

I'm currently dealing with a couple of user accounts containing MD5 hashed passwords. These accounts got migrated from an old system into our current system which uses PBKDF2 for password hashing. I ...
27
votes
3answers
4k views

Can I share what password hash function I used in a public report?

I have developed a web site during an internship, using a database with accounts. I used the crypt() method from PHP, with a secured algorithm plus salt (found on the web with a lot of feedback). ...
21
votes
4answers
18k views

Whats the difference between MAC vs hash

What is the difference between the two algorithms? One difference that I know of, is that MAC is keyed and hash is not.
0
votes
0answers
37 views

ISO 9564 Approved Encryption Algorithms for PIN, why symmetric block ciphers?

I am currently researching best practices in designing a potential PIN management solution for a financial services application and began looking into ISO 9564 as a source of requirements. One of the ...
7
votes
3answers
17k views

Generating an unguessable token for confirmation e-mails

I'm generating a token to be used when clicking on the link in a verification e-mail. I plan on using uniqid() but the output will be predictable allowing an attacker to bypass the confirmation e-...
2
votes
1answer
118 views

PHP BLENC extension security concern

PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
1
vote
1answer
75 views

Firmware protection scheme

Edit: I have found a scheme that fits my limits (little memory, only AES is available): AES-CMAC described in RFC 4493 (just remember to use different key for encryption and MAC ;) . I am working ...
2
votes
1answer
175 views

Which file encryption algorithm is used by Synology's Cloud Sync feature? [closed]

I'm trying to find out which encryption method is used by a piece of software I use, viz. the 'Cloud Sync' feature of Synology's DSM 6.0 running on a Synology NAS. (Background. This Cloud Sync ...
1
vote
1answer
82 views

Multi hash security [duplicate]

Is md5(sha1(pass)) more secure than md5(pass)? For example in case of sqli when an attacker can't get our hashing schema, brute force or dictionary attack would be much less efficient. Am I right or ...
-5
votes
1answer
132 views

Where do webstites store the hashes? [closed]

I understand that lots of websites store passwords in hashes but where do they actually store the hashes? How can a website compare your hashed version of a password with theirs? Is it stored ...
1
vote
1answer
76 views

Is using dynamic obfuscation and peppers for password hashing a good idea?

I've read now the whole day about password hashing and secure authentication and though I read very often that mostly every own algorithm makes the proven hashing methods just less secure, I just got ...
4
votes
1answer
102 views

Is it possible to use parallelism when computing a key derivation function for a single password/key?

Suppose I have an AES-256 encrypted file, and I want to derive the key using PBKDF2 and a given salt with a large number of rounds (say 1 million), but I'm limited by user tolerance for UI lag when ...
1
vote
1answer
97 views

Password Encryption For PHP 5.3 or Should We Update to 5.5+?

I'm trying to hash passwords for our company site. After testing on a local Apache server that has PHP 5.5.9 and everything working as expected, I went to test on our live server being hosted by ...
1
vote
3answers
269 views

why don't we store passwords in a database using encryption instead of hashing? [duplicate]

hashing is a one way method, if a user lost his password he will never be able to get that password from the server, so why don't we store passwords in a database using encryption instead of hashing?
0
votes
0answers
47 views

How to extract the hash from SMB

I have a running PC which I need to test against.It is running Windows with SMB enabled. When capturing using Wireshark while connecting with an incorrect password I see packets being sent to / from ...
0
votes
1answer
39 views

If domain admin account's NTLM hash is compromised, can it be used to access any machine in network

If a hacker able to get local admin rights and then from there local domain admin's NTLM hash. Can he use this hash without cracking, to access shared folders in the network and the default C drive ...
13
votes
1answer
571 views

Naive implementation of Rainbow Table and/or Hellman's trade-off

This question is the same one I asked here. Since I haven't got any response or even a comment I will post it here as well. Is there any naive implementation of Hellman's cryptanalytic time memory ...
0
votes
2answers
107 views

Secure password generation for different websites [duplicate]

I came up with the idea to generate passwords for internet sites by the following shema: $masterpassword $hostname $TLD hashfunction($TDL.$masterpassword.$hostname) So the actual password is a ...
-3
votes
2answers
97 views

Will hashing a password, and then splitting it into multiple db fields increase security? [duplicate]

I've been reading up on Password hashing, and it seems like there is a lot of opinions on "What's right." I'm curious about the possibility of storing a split of a Hashed password in multiple user ...
34
votes
5answers
5k views

Should I trust a website which uses a SHA-1 HTTPS certificate?

I am on a website where I need to pay for something. This website has the following warning in the top left: This site uses a weak security configuration (SHA-1 signatures) so your connection ...
1
vote
1answer
112 views

How to implement iterations when hashing passwords?

To securely hash passwords, algorithms such as PBKDF2 do many iterations of a common hash such as SHA1. Are there certain ways that these iterations need to be done to be safe? In particular, from ...
59
votes
3answers
43k views

Securing a JavaScript Single Page App with RESTful backend

I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
0
votes
0answers
20 views

Securing FTP Creds in a Java Open Source API

I've written a basic Java API and source code must be released to a small community for the application to function correctly. The Java API helps developers track data for their running scripts and ...
0
votes
1answer
87 views

Possible to take hash from know result and algorithm?

I am trying to build a casino site in PHP where users can play roulette. I found this algorithm that I want to use to "roll" numbers: <?php $secret = '...
0
votes
2answers
164 views

store passwords as one-way-hash, or just use it as an AES key?

I want to store some data so the only one who'll be able to access it is the user itself. Here is my idea: when user registers, his password will be hashed in SHA256 (so it'll fit as an AES key), and ...
19
votes
2answers
3k views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
-1
votes
1answer
552 views

SQLMAP --OS-SHELL error [closed]

root@kali:~# sqlmap -u http://www.a***********.com/info.php?id=2 --os-shell _ _ _| |_____ _ {1.0-dev-nongit-20150907} | -| . | | | .'| . | || |||||,| | || |_| http:/...
14
votes
6answers
8k views

Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() “better” for Unicode Password hashing than traditional methods?

When is it appropriate to use RFC2898DeriveBytes versus a typical hash? Update I now understand that a KDF is typically used to create a symmetric key for possible use in encrypting a stream. I ...
1
vote
0answers
20 views

How do atom's apm and npm verify package integrity?

Are there built in verification methods to make sure the packages contain the correct code? Do they use a hash of some sort?
1
vote
1answer
97 views

How does JDBC send passwords to the server?

I am really curious about how JDBC sends passwords to the server. While I understand that is simply an API and it depends on the implementation, are they usually hashed and then sent to server? If I ...
5
votes
3answers
232 views

How to check if your Android app was updated by MitM?

As I was browsing on my phone yesterday, a gray popup appeared on my screen just as I was swiping up, and I accidentally hit the accept button. In the fraction of a second it was on I was able to read ...
1
vote
1answer
37 views

Possible number of collisions in a hashing function with constant message size

Jumping to conclusions from my question, can we predict possible number of collisions for a given message in a given hashing algorithm. Say I am using SHA-1 which outputs 160 characters string, and ...
-1
votes
1answer
58 views

Shouldn't multiple images always exist even in most powerful hashing algorithm?

I have a confusion in mind that since in hashing we transform a large string into a smaller fixed size string, so its unlikely that any large string has a unique hash. There had to be collisions and ...
53
votes
4answers
116k views

Is SHA1 better than md5 only because it generates a hash of 160 bits?

It is well known that SHA1 is recommended more than md5 for hashing since md5 is practically broken as lot of collisions have been found. With the birthday attack, it is possible to get a collision ...
2
votes
0answers
68 views

How exactly does “Apache Shiro's” hashing work when using a Desktop-Client

I was looking at this question How does storing hash passwords work? and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. ...
13
votes
1answer
3k views

Should I hash my passwords even if I am only allowed to generate limited traffic?

At this moment I'm busy working on an webapp with a friend of mine. The main problem we have is that we are only allowed to generate 50 GB a month in datatraffic. My question is: Does hashing the ...
-5
votes
1answer
94 views

Time to break SHA-512 [closed]

From http://stackoverflow.com/questions/6776050/how-long-to-brute-force-a-salted-sha-512-hash-salt-provided, to break SHA-512 with brute force strategy, it require 3,17 * 10^64 years. It is almost ...
0
votes
1answer
90 views

How many hashes do I need to compute to get x collisions?

I know that you need to hash about 2^(N/2) to find a collision taking into account the birthday problem. But I'm not really sure about more than one collision, I mean, collisions with different ...
17
votes
8answers
4k views

Won't all hashes collide after enough iterations with a static salt?

We all know that we're supposed to take a fairly slow hashing algorithm, salt the password, and run the hash for many iterations. Let's say that I'm following almost everything except for one rule, ...
43
votes
4answers
33k views

Are salted SHA-256/512 hashes still safe if the hashes and their salts are exposed?

Scenario: a database of hashed and and salted passwords, including salts for each password, is stolen by a malicious user. Passwords are 6-10 chars long and chosen by non-technical users. Can this ...
1
vote
2answers
451 views

How to store the access token / password reset token in the database?

I have an access code that is sent to users so that they can access the site in one-click. From terms of access it's very similar to the password reset url, so I assume the same assumptions apply. E....
1
vote
1answer
130 views

How can one securely hash passwords server side while avoiding DoS?

It is generally recommended that one use a slow hash function to hash passwords. However, does this create a DoS risk?
4
votes
1answer
158 views

Is the 64-bits length of the original string padded as well in the MD5 hashfunction?

So, for example I have a string which binary value is exactly 512 - 64 bits long, so the binary conversion of the string does not have to be padded. So that means I have a string of 56 chars. The ...
15
votes
2answers
1k views

What's the difference between a hashed and an encrypted password?

Alright, so I know this may sound dumb, but I'm having a hard time understanding what an encryption would be since it's different from a hash. I've read up on it, but I'm still not quite sure. So, I ...
35
votes
8answers
4k views

Find matching phone numbers without actually knowing them

We have a mobile app that, given two users, needs to let them see what common contacts they have based on their phone numbers. How can we do this in a cryptographically secure way and respecting the ...
6
votes
2answers
813 views

Is it safe to publish something encrypted with a password if you make it insanely difficult to crack?

Let's say you have a very important private key that you don't want to lose. You think of posting it to http://pastebin.com/ but then relize that elimanates the point. So you think of encrypting with ...
9
votes
6answers
1k views

Does repeating one word to form a password result in a similar pattern in its encrypted format?

If i use a single word to form a password by repeating it like the examples below: securesecuresecuresecuresecuresecure SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe $eCuRe$eCuRe$eCuRe$...
0
votes
2answers
97 views

How do data breaches of account login information end up in plaintext?

For example, see this story. Am I missing something here? Are the login details actually still encrypted? I don't understand how it is possible for a data breach of what I assume is encrypted ...