A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

2
votes
2answers
110 views

Where to store a pepper?

Assuming you're using a pepper in your password hashing, where should it be stored? I know you shouldn't store it in the database since it can easily be found there during a dump and the idea is to ...
81
votes
10answers
9k views

Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?

I always hear "A long password is good, a longer password is better". But is there such a thing as a "Password is so long it is becoming unsafe" or "Password is long enough, making it longer won't ...
3
votes
1answer
137 views

MD5 Algorithm: A basic explanation of the process

Could anyone please explain the basic idea and steps involved in the MD5 algorithm? I tried reading it on the web (Wikipedia etc.), but it was just too high level for me. So, can someone explain the ...
0
votes
0answers
138 views

HMAC Token - Check Logic

I have a situation where I need a token that provides authentication. The common HMAC procedure I found is: Get Some key using login credentials Create Message, append key and other message data ...
6
votes
2answers
1k views

Can I use SHA-512 hash as AES key?

I want to combine hashing and encryption for better security. So can I use a hash key generated from SHA-512 as a key in AES. For example, I have a password "secret", I calculate SHA-512 hash for it ...
30
votes
2answers
3k views

Is it possible to get hacked if my bcrypt hash is publically known?

I just checked https://haveibeenpwned.com/ and I have noticed that I was pwned, therefore I checked the file that hosts the details of my "credentials", however, I see my email in plain text but the ...
2
votes
1answer
70 views

What fuzzy hashing algorithms exist?

I have been trying to find information on fuzzy hashes, and I have found surprisingly little. I know that fuzzy hashes can be used to detect if a piece of malware has changed slightly. I would rather ...
6
votes
2answers
168 views

How is SHA-1 insecure if it is not vulnerable to what MD5 is?

I have been hearing a lot lately about how SHA-1 is no longer going to be used because of how weak and insecure it is, but if it is not vulnerable to collisions like MD5 is, then how is it weak and ...
7
votes
3answers
77 views

Does verifying an additional fraction of a file decrease the chances of collision?

If I have a file of indeterminate length and I generate the SHA256 of that file, then generate the SHA256 of the first half and the last half, then verify all three, does that decrease the odds of a ...
2
votes
1answer
97 views

Is storing encrypted and hashed versions of the same data less secure?

I have some database columns which are encrypted. Obviously there is no way to filter these by plaintext value. As the data stored in the db is ~~salted~~ combined with the IV, there is no way to ...
0
votes
1answer
86 views

How many hashes do I need to compute to get x collisions?

I know that you need to hash about 2^(N/2) to find a collision taking into account the birthday problem. But I'm not really sure about more than one collision, I mean, collisions with different ...
2
votes
3answers
51 views

Pre-generating 'secure tokens'

In our web app we make good use of single use tokens. For example, when somebody creates any of the three "accounts", resets their password, or any other number of things that require random ...
7
votes
1answer
157 views

Increasing the Calculation Cost of Hashing [duplicate]

Is this a secure way to increase the calculation cost of md5 or sha1? public static byte[] increaseHashComplexityMd5(byte[] hash, int loops) { for(int loop = 1; loop <= loops; loop++) { ...
2
votes
1answer
62 views

php's password_hash with system wide salt [duplicate]

I'm thinking about using password_hash function for generating password hashes. I have read that own salts shouldn't be generated and instead use the default one that the function generates. Own salts ...
1
vote
2answers
69 views

How can i Identify and use hash function given enough text and their hash?

So, I have this old program currently in use, as i have access to the database i have adopted all data i need except the user passwords.. Now users will provide me with the plain text password and ...
3
votes
1answer
77 views

Can I generate a random 32 bit key by using the Java hashCode and random English words?

I want to generate and communicate a 32 bit key to Bob over a phone conversation. I know he happens to have the same Java and OS installed as I have. Suppose I have a dictionary of 100,000 (English) ...
0
votes
1answer
78 views

Checking a salted hash against known password?

I've created a mysql dump of my users and passwords and awked them into a presentable form: Passwords: ...
1
vote
3answers
85 views

Are hashing functions designed to be injective where the domain is limited to the codomain?

Using the example of md5, I would like to know if md5(h₀) == md5(h₁) for some distinct md5 hashes h₀, h₁. Are hashing algorithms generally designed to avoid this sort of collision? Do MD5, SHA1, ...
32
votes
7answers
5k views

How to prevent username and password matches when changing a username?

Let's say that I have a system where one of the security requirements is preventing users from choosing a password that matches their username. Usernames are not case sensitive but the passwords are. ...
5
votes
2answers
151 views

Why is weakness of SHA-1 considered a threat to TLS security

If I understand correctly the role that a hashing algorithm (e.g. SHA-1) plays in TLS certificates is as follows: The hashing function is applied to a subject's public key. The CA then uses their ...
0
votes
1answer
77 views

Is there a way to securely check if a password is one of the most used ones?

So lets's say that a user wants to register to some website. For whatever reason, I want to not allow that password if it is one of the top 100 passwords used on my site (So I'm not checking against ...
3
votes
1answer
193 views

Is this encrypted information? Why is it in a URL?

There's a vendor who sends us reports full of links to articles. Some of these links, especially ones that perform what I'm guessing is an HTTP verb of some kind, look like this: ...
1
vote
6answers
4k views

Is this authentication scheme secure?

I want to authenticate a client of a webpage and make sure it is a particular user. Let say that we already agreed on a particular hash (SHA256, actually, which I think is secure enough for this) and ...
0
votes
2answers
104 views

Password based Asymmetric Key generation

I am looking for a password based key derivation scheme that results in an asymmetric key pair. I have worked with PBKDF and its variants but could not come up with any way of generating a key pair. I ...
2
votes
1answer
116 views

How might a PIN based Web authentication scheme work?

I'm interested in implementing PIN based authentication for a web application, similar to what Facebook provides in their mobile web site. Here is the user flow: User visits the site for the first ...
-2
votes
2answers
56 views

Is there a reason to salt instead of enxrypting data? [duplicate]

Is it more secure to: a) Take a password, salt it, then hash it. b) Take a password, hash it, then encrypt it(Using a symmetric algorithm with a large key)
3
votes
2answers
659 views

Getting reliable checksums

Update: A version of transmission that contains malware has been distributed very recently. Quoting this ars technica article: It appears that somehow the Transmission website may have been ...
5
votes
2answers
198 views

Why use MD4 for caching?

ccache is a popular tool for speeding recompilation with GCC and other compilers. It works by caching previous compilations and detecting when the same compilation is done again. The detection is ...
12
votes
2answers
2k views

If multiple users on the same website all use the same password, is their password hash the same? [duplicate]

My basic knowledge would assume yes, unless websites somehow include the user name into the hashing function with the password, but I am not sure if this is common practice.
45
votes
4answers
5k views

Is this a self rolled hashing/obfuscation method? Can you recognize the pattern?

A system we're introducing into the organization is not using any traditional hashing function that I can find. I've been assigned to "approve" it by black-box testing. I suspect passwords are simply ...
2
votes
3answers
64 views

Why do websites use less effective hash functions? [duplicate]

When releasing, say, ISO files, the websites usually provide the supposed hash of the ISO to compare with, to verify its integrity. Or, to prove that it at least probably wasn't tampered with. But on ...
3
votes
1answer
156 views

Best way to hash passwords in PHP 5.3.5

What is the best way to hash passwords in PHP 5.3.5? Since in this version doesn't have password_hash().
0
votes
1answer
90 views

How can I ensure that only the message I sent, and nothing else reaches the receiver?

How do I make sure that the open channel I use to send a message to a specific receiver, is not used by a third party to send unwanted files and compromise the receivers system? Is there a method by ...
1
vote
3answers
116 views

Signatures for an antivirus

When anti-virus software compares an MD5 signature for malware, does it execute the malware on my computer in order to generate the appropriate signature to compare against? [ORIGINAL QUESTION] MD5 ...
0
votes
3answers
96 views

How does encryption force a processor to “pause”?

I'm often told that encryption forces processors to "make a pause" when performing the math to decrypt a hash, which is why brute forcing can take so long. I don't understand what it means for a ...
5
votes
2answers
138 views

Why are we using SHA3-512?

As we know, hash algorithms can be used for authenticity of a message. In my understanding, since the message lengths are too large, we convert it into a hash value using hash algorithms and these ...
1
vote
0answers
114 views

Can password hashing both client side and on the back end improve security if we don't necessarily trust the server? [duplicate]

I want to know if it ever makes sense to hash a password client side and rehash it again on the back end. I've not seen this done before which makes me suspicious as to whether it really does add ...
0
votes
0answers
15 views

Is encryption with a destroyed key a good cryptographic hash function? [duplicate]

Obviously this isn't something I was going to implement, but it was a question floating at the back of my mind. So let's say that instead of hashing passwords to store in the database, you encrypt ...
-2
votes
2answers
167 views

How to securely transfer password from a registration page to the database [duplicate]

What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http) when the user registers for the first time ...
4
votes
2answers
178 views

Location of Password Hashes on a Windows Local Machine?

"Where are the two locations that user's password hashes are stored on a local windows machine?" My place of business asked me this question. I know that the SAM stores password hashes, where would ...
-7
votes
2answers
213 views

What is is the best way to create virus signature database? [closed]

We are thinking to develop a new Antivirus program. The main concern is to create a virus signature database. I want to ask what is the best possible way to add viruses signature in our database to ...
1
vote
0answers
39 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
1
vote
1answer
129 views

How can one securely hash passwords server side while avoiding DoS?

It is generally recommended that one use a slow hash function to hash passwords. However, does this create a DoS risk?
8
votes
2answers
103 views

Is there a threshold of bits of entropy below which hashing becomes meaningless?

I just read a help page by a mail provider in which they state that all mobile phone numbers will be stored as a salted hash. This strikes me as interesting, since phone numbers don't contain a lot ...
2
votes
3answers
113 views

Verify password hashed with nonce when the password is already hashed on the server?

I found this picture in the Wikipedia nonce article: To avoid sending the password in clear text and prevent replay attacks, the password is hashed together with one random number from the server ...
1
vote
3answers
148 views

why not use hashed password as password [duplicate]

Why dont we use our mobile phone tho hash a password and then enter the hash on a website as the password ? This way the password for the website would be much more complex. Would this even increase ...
-5
votes
3answers
81 views

how to know the way in which password was encrypted [closed]

i have a encrypted password basically hashed i don't know what it is some thing like 11dfb34b27f539a5e785b68e529fd470 and i know the password i.e., the plain text but i want to know the way that how ...
1
vote
2answers
95 views

Isn't oAuth weaker than traditional passwords

I understand the need for oauth for programmatic access to apis, etc. whereas passwords are used for more human-level authentication. However when we store passwords, we (hopefully) salt + hash them. ...
0
votes
2answers
68 views

PGP vs Hash functions

What is the difference (in terms of security strength) between checking a package' integrity using pgp and hashing functions (i.e. sha256)? Isn't pgp less secure as the verifier must trust the ...
-2
votes
1answer
55 views

What reasons for implementing reversibly encrypted data are there? [closed]

Excuse me if I am wrong, as I am very new to the field, but it seems that the only reason one should encrypt something in a reversible way is if the object receiving the encrypted data is a person. ...