A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

3
votes
2answers
182 views

Hashing password multiple times with different random salts

I have read a lot of answers about this topic like: https://programmers.stackexchange.com/questions/115406/is-it-more-secure-to-hash-a-password-multiple-times. ...
1
vote
0answers
45 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
-2
votes
1answer
76 views

Unconditionally Secure Authentication

I'm trying to add the authentication for my One-Time Pad implementation. I know that to provide Unconditionally Secure Authentication I need to use the One-Time MAC authentication. But I don't ...
3
votes
0answers
59 views

Reviews of Argon2

I am not a security guy but just curious about the things here. I have seen several people in various answers here talked about the password hashing competition. Now that the winner is announced, I ...
0
votes
0answers
24 views

Malicious node in distributed hash table (Tor)

I'm thinking about the DHT in Tor that is used to look up hidden services. Namely, if you were running a node in the Tor DHT system, 1) Could you realise that you were storing the data for a nasty ...
33
votes
4answers
3k views

Does every hash value have an inverse value?

There are many different hash functions, md5, sha, and others. They take a value V and produce a H via transformation Function(V) = H, where Function is md5, sha, etc. My question is: Does every hash ...
16
votes
3answers
3k views

Have weaknesses in SHA-1 and MD5 ever actually been successfully used in an attack?

Pretty much every guide, how-to, and reference for dealing with passwords and hashing has a warning in big or bold letters stating something along the lines of: SHA-1 and MD5 are NOT secure and ...
1
vote
0answers
83 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...
0
votes
1answer
49 views

Software activation “by phone” [closed]

I'm a software developer, and I would like to protect my application in an offline way, like many software do activating by phone. Following a screenshot taken from google images on what I would like ...
0
votes
0answers
33 views

Generation of the primes p,q and g for DSA using an Hash Function in OpenSSL

We can generate primes p,q and g for DSA in OpenSSL by using command: openssl dsaparam -text -out dsaparam.pem 1024 Is it possible to generate primes p , q and g using an Hash Function in OpenSSL ...
1
vote
1answer
141 views

Decoding base64 encoded message with a key [closed]

I am pentesting a database that where I found data which was base64 encoded. I tried the usual method of decoding base64, which didn't work. Later, I found in database a field called ...
1
vote
1answer
54 views

PBKDF2 constants

I recently found this PBKDF2 code: <?php /* * Password Hashing With PBKDF2 (http://crackstation.net/hashing-security.htm). * Copyright (c) 2013, Taylor Hornby * All rights reserved. * * ...
13
votes
2answers
2k views

Are SHA-2 certificates considered obsolete, or current?

I read here that I should be using SHA-2 certificates to secure a HTTPS webserver. Are SHA-2 certificates considered obsolete, or current for TLS/SSL website certificates? (as of 11/20/2015). If ...
0
votes
1answer
42 views

Md5 vs Md4 recognition

Is there a way to actually find out whether a hash is MD5 or MD4? For instance: 10c7ccc7a4f0aff03c915c485565b9da is an MD5 hash be08c2de91787c51e7aee5dd16ca4f76 is an MD4 hash I know that there ...
1
vote
3answers
200 views

Hash for secure file downloads? [closed]

Is there any hash structure that can be used for secure download of a file and validation of its contents? Looks like all hashes like MD5 are made for consistency check and are vulnerable to hash ...
-1
votes
2answers
99 views

Using a password hash…as the password? [duplicate]

Ok, this is probably a really stupid idea, but I can't really see why it would be a bad idea. Maybe someone can enlighten me. Why couldn't you enter a password good hashing algorithm like bcrypt, ...
0
votes
1answer
114 views

How can I detect if hashes are salted? [duplicate]

Is it possible to detect hash function of a hash if I don't have access to PHP code? I know that if a hash is some kind of MD5, but I don't know if there is salt etc.
3
votes
1answer
63 views

Does salt increase security if there is only a single hashed password?

Say there is only a single hashed password in the passwords file. If it was salted, would that make it more secure? My logic is: Yes because SALT helps protect against rainbow tables and dictionary ...
6
votes
2answers
44 views

Is there an entropy difference between hashing an encoded string?

Of course if I apply (for example) SHA-2 to a base64 encoded string it will give me a different result versus the original data, but from a strength-perspective in terms of entropy, is there a ...
4
votes
4answers
155 views

Must an encrypted hash value be bigger than the password it was generated from?

I was reading a book called Introduction to network security theory and practice, and I found the following paragraph: Rainbow Tables A rainbow table is a table of two columns constructed as ...
5
votes
2answers
128 views

How to check if your Android app was updated by MitM?

As I was browsing on my phone yesterday, a gray popup appeared on my screen just as I was swiping up, and I accidentally hit the accept button. In the fraction of a second it was on I was able to read ...
8
votes
3answers
2k views

Is it easier to get the original password if you have multiple hashes of it, all created with the same hash function?

If you have multiple hashes of a password, all hashed with the same hash function, is it possible to use this to speed up retrieval of the original password in any way? (I found the question "is it ...
5
votes
1answer
969 views

Should I be worried about brute-forcing passwords that encrypts AES?

I am building an application that needs to locally store sensitive data, that is encrypted using the sha256 of a password provided by the user. It uses AES for encryption. I am worried that some ...
2
votes
1answer
79 views

Why hashing algorithms in layer 2 are weak? [closed]

It's known that hashing algorithms such as md5 and SHA1 are weak and can easily be cracked. I wonder why many layer 2 and 3 devices such as cisco switches still use weak hashing algorithms but don't ...
5
votes
1answer
92 views

If I obtained a username and the salted password pairs from a server, can I login?

I am studying Salted Challenge Response Authentication Mechanism (SCRAM). According to the description at https://tools.ietf.org/html/rfc5802#page-8 it seems that the Client does not have to know ...
41
votes
12answers
10k views

Is there any real value in hashing/salting passwords?

I look after a system which holds a lot of "low grade" information, nothing financial but name/address/email etc. Someone has suggested that we up the security from the current in house password ...
3
votes
1answer
279 views

How could a publicly available stream cipher (RC4) be kept secret so long?

I'm reading about the cryptographic function called RC4. Apparently, its method was kept secret from 1987 until 1994 despite being available to the public for licensing and use. How did it stay ...
1
vote
2answers
641 views

Why can't an n-bit hash be cracked by hashing every single n-bit plaintext?

I'm wondering why it's so hard to find collisions for cryptographic hashes. Take for example a hash function that outputs a 64 bit hash. In order to find collisions, if you feed the function every ...
1
vote
2answers
67 views

What type of hash is this? Just to verify my assumption [closed]

vwTjXNzdPQQMxhyYGB6jvxJW12hjCUG4rLDxtVevwdg=:StM_M8a4HxYpL5I-HteQqmINjjuPtOw9wPcoCacK_qk= It looks like a base64 but when I try to decrypt it, it doesn't work. I read about some hash having this ...
1
vote
2answers
99 views

Why is finding a strong collision only half the work of a weak collision?

Regarding hash collisions, an attacker only has to do half of the work to find a collision when they can control both messages compared to when they are trying to find a weak collision. This can be ...
3
votes
1answer
308 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
3
votes
2answers
178 views

Why does LastPass store password hashes on the server at all?

While reading about LastPass' breach, I was wondering why would LastPass store strengthened password hashes at all on the server side? Could they only store the AES encrypted data and when the user ...
0
votes
0answers
58 views

Hashing Identifiers to Create Pseudonyms

I'm wanting to share datasets between two organisations in a pseudonymised way such that they link together via mutual entities (e.g. people) but so that the entities cannot be identified. E.g.: ...
4
votes
3answers
239 views

Question regarding MAC and encryption

I was reading the chosen answer to the following question - "MAC vs Encryption" They say that just using encryption, "an attacker could alter the ciphertext to make it say something else when ...
5
votes
1answer
89 views

Salting/Hashing a password

I don't have a security background, so I'm not sure on the best approach for this, I'm developing an android app which users will need to login to (all local). I'm going to store the password in a ...
2
votes
2answers
81 views

which encryption is used in this JS Variables

Which encryption method is used for these variable names: var g_license_info var g_server_time_obj Respectfully encrypted to: var ago05b4e111efe149737a67a177f00ffad2 var ...
4
votes
1answer
96 views

A predictable password generator for offline clients

I know this sounds like pretty dumb question. Why would you use a password generator at all if it's predictable. But suppose you have a server and client - the server always requires a password and ...
3
votes
0answers
87 views

How far should I go in protecting a user's SMBIOS UUID?

My server will be receiving data from several hundreds of computers. As part of keeping track of which computer sent what, I will be fingerprinting the hardware and keeping the results in my database. ...
4
votes
1answer
155 views

Why is Windows password security designed this way? [duplicate]

Let's start with the LM hash. The LanMan hash had MONUMENTAL security flaws, like the password being case insensitive (converted to upper), which reduced the keyspace for a brute force attack. On top ...
0
votes
1answer
176 views

Is this a good hash function?

unsigned int hash(bytearray[] msg) { unsigned int hash = 0xDECAFEBAD; for(i = 0; i < msg.length(); i++) { hash = ((hash << 4) XOR (hash >> 28)) XOR msg[i]; } return ...
5
votes
2answers
566 views

Why not slightly modify an existing hashfunction to create your own? [duplicate]

I read this interesting question on why improvising your own Hash function out of existing hash functions is bad. However this is specifically focusing on 'mixing' existing hashfunctions. What if for ...
3
votes
2answers
156 views

How to give “Forgot password” option for a password encrypted file?

I have created a utility that encrypts a file (.txt, .dox, so on...). The utility asks for a password from user at the time of file encryption. Problem Suppose a user has created 1000 encrypted ...
1
vote
3answers
114 views

how to authenticate user in client-server implementation

So I am trying to implement a client-server application for sending files over SSL sockets. And I am trying to decide on a very secure design for authenticating the client. The server is going to ...
5
votes
3answers
162 views

How to prevent a prophecy from becoming self-fulfilling or self-defeating

Let's assume that I have deduced with a high probability what a certain famous person or organization will choose to do at a near-future date. How can I publish any proof of me having deduced this? ...
-3
votes
1answer
73 views

Hash regex for malware recognition [closed]

I'm looking to store two types of hashes for recognizing blacklisted code. These are the FireEye "import hash" (or imphash) and the ssdeep "fuzzy hash". Is there a regex (or formal documentation) I ...
1
vote
1answer
102 views

best practices for storing retrievable passwords

I am trying to build a NMS (network management system) and I am required to store passwords for 3rd party databases, devices and servers that are being managed (not user passwords). These passwords ...
4
votes
0answers
211 views

OpenSSL 0.9.6a PRNG algorithm weakness: How to exploit?

I saw an OpenSSL security advisory for Openssl 0.9.6a Recently a cryptographic flaw in OpenSSL's built-in pseudo-random number generator (PRNG) was pointed out to us by Markku-Juhani O. Saarinen ...
2
votes
2answers
103 views

Best hash for indexing and searching encrypted data

I would like to be able to do database look-ups on a set of data based on one of the encrypted fields. My understanding of the best practice for accomplishing this is to store a hash of the data I ...
2
votes
1answer
94 views

Yii client side captcha validation

Apparently, Yii web application framework generates some kind of hash value from captcha codes it generates and sends it to the client side so it can be used for client side validation of the captcha ...
3
votes
1answer
479 views

Can I know somehow if my password hash is known?

Is there a secure way to know if my password's hash is publicly known on the internet? First I tried to search for it in Hashes.org (http://hashes.org/search.php), but then I suspected, that if it ...