A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
3
votes
2answers
186 views
File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?
I've been using this command to encrypt files for a while now:
openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc
Then I type in a password.
Can someone tell me, roughly speaking, ...
2
votes
1answer
123 views
Legality and ethics of cryptanalysis on password hashes
I'm working on my dissertation concerning cryptanalysis on password hashes. I'd like to delve into the legal and ethical aspects of cryptanalysis, however, seeing as I'n not at all well versed in law ...
6
votes
2answers
228 views
How to proceed if a new hash algorithm for passwords is introduced?
I have an e-mail address at a certain institution. A few days ago they sent me an e-mail (in German), which I'd like to paraphrase without revealing the institution:
Dear Madams and Sirs,
a ...
6
votes
5answers
285 views
Can I determine which algorithm was used if I know the matching hash of a given input?
If I know original text "12345" which encodes to "Tut0nlFFZ9sLVhPE5x81lQ==", how I can identify hashing algorithm?
2
votes
1answer
50 views
What is the purpose of the hashcode used in Exchange OWA HTTP requests?
This blog describes the URLs that are used in OWA and webservices. It also says that there is a hashcode that is used in conjunction with the throttling policy.
Is this hashcode responsible for ...
3
votes
2answers
127 views
Confidentiality and integrity for web session
When the client authenticates with our service, he is issued an opaque "token". This token includes the information, that identifies the client and some other information about the client ("payload"). ...
3
votes
5answers
330 views
The security level in hash function
What is the difference in security between using part of message digest hash function or all the message digest hash function? and is there any equation can calculate the security for part or whole ...
18
votes
5answers
1k views
What is the point of hashing passwords?
Even when following strict security protocols, and what the user typed is (in this hypothetical situation) completely impossible to derive, the key that the server needs to compare to is still there. ...
9
votes
3answers
1k views
Cracking MS-CACHE v2 hashes using GPU
As most people here will know, Windows caches domain/AD credentials in a format known as MS-Cache v2. Obviously, these would be excellent passwords to gain during a penetration test when local access ...
2
votes
2answers
257 views
Why doesn't Microsoft implement salt on users passwords in Windows?
Pretty straightforward - So we use rainbow tables to get passwords of users out of hashes. So why won't Microsoft implement salt on the passwords in Windows to be hash(password+salt)?
Won't this ...
0
votes
0answers
34 views
Database hash for password field [duplicate]
I'm using a mysql database and am looking for a cryptographic hash method for a password with salt added to it. What would be the best hash method for this problem?
2
votes
1answer
177 views
sha-512 vs sha-3? [duplicate]
Does the new SHA-3 Keccak hashing algorithm offer any benefits from SHA-512?
"Even worse, none of the SHA-3 candidates is significantly better. When SHA-3 is announced, I'm going to recommend that, ...
2
votes
1answer
323 views
Using John the Ripper to crack SHA hash w/ partial knowledge
Group, I have a SHA1 hash that I would like to brute-force. I have knowledge of several characters before and after the password (ie, if the hash is derived from "xxxpasswordyyy", I know both xxx and ...
-1
votes
3answers
57 views
Secure transmission for desktop applications
Suppose I have a desktop application that does password hashing for login authentication.
Is the password normally hashed before it travels to the wires or does it travel to the wires first in plain ...
1
vote
2answers
116 views
Creating a rainbow table with predefined text
I need to extract a password from a hash. This hash was generated by prepending and appending two different predefined strings to the password:
Hash(PredefinedString1+Password+PredefinedString2)
...
2
votes
2answers
195 views
What is this hashing algorithm?
I need to authenticate against another programs user credentials to allow access to a second tie-in system. I am having trouble figuring out what hashing algorithm is being used by the first program ...
3
votes
2answers
93 views
Fixing the high-bit problem in PHP's crypt() implementation
I'm working on a site that has to have compatibility with older versions of PHP, which suffer from a high-bit issue in the Blowfish crypt() implementation. Essentially, non-ASCII characters are not ...
0
votes
1answer
117 views
Determine hashing algorthim only with known input and output
Given the input:
test
A system generates the following output hash:
0x001F41B6A0534D3B851D69EFE6237F550100000010D5F4FC65E64BCFDBF2590212E4411C44942C6C734C00ACFE13B958DCAB3614
I do not know ...
0
votes
4answers
221 views
Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?
I am creating a page on a website that will show a user some authorized information from another website, and that website uses a combination of the user's user-number and a secret passphrase hashed ...
2
votes
1answer
162 views
Loki How to crack the password hash OSPF?
I have created for myself a lab of routers in GNS3 . Routing protocol between routers is OSPF.
Now,by Loki penetration testing, I found that routers are the feature authentication.
Using wireshark, I ...
5
votes
3answers
228 views
Use of rainbow tables with the NY Times hack?
The NY Times recently published a story about how they were hacked during a four month period. The hacks allegedly were carried out by part of the Chinese military.
One part of the story that ...
2
votes
2answers
113 views
Easy protocol for email authentication
I'm cooking up a very simple system to send commands to a remote server via email. Everytime an email is sent to do_something@mydomain.net, the server runs a python script that does something ...
2
votes
2answers
347 views
Salted hashes vs HMAC?
Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
3
votes
2answers
265 views
How does processor architecture affect password hashing speed?
Does hashing speed vary significantly using different architectures (x86 vs ARM)?
Scenario
I am investigating the possibility of using a cluster of Raspberry Pi for cracking passwords hashed with ...
1
vote
1answer
194 views
I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]
Possible Duplicate:
Password Hashing add salt + pepper or is salt enough?
How to store salt?
Ok I have been studying a lot about password hashing lately. And I have a few questions. So I ...
7
votes
2answers
210 views
Content hashes to help protect resources being fetched from a CDN
During a conversation in The DMZ, it was suggested that an SHA256 hash could be used to check that content being delivered from a CDN hasn't changed before being executed, similar to how Kim Dotcom's ...
3
votes
2answers
200 views
is it easier to get the original password if you have multiple hashes of it?
Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
2
votes
1answer
118 views
Can a salted hash be an effective MAC?
An HMAC is basically a "keyed hash". Only the correct message and the correct key will produce a particular hash digest efficiently.
Conceptually speaking, the same can be said for a salted hash; ...
3
votes
0answers
275 views
Can an attacker guess my password length from a hash? [duplicate]
Possible Duplicate:
Possible to detect password length from hash? Is doubling your password adds more security?
Considering I do not provide him any personal information relating to it, are ...
1
vote
5answers
287 views
Is SHA-1 encryption?
I have read that SHA-1 is a cryptographic hash function. On an exam, SHA-1 was given as a possible one-way encryption algorithm. Does SHA-1 require a key as input? Is a key required to qualify as ...
3
votes
4answers
186 views
When hashing passwords, is it okay to store the algorithm used right there in the database?
Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
1
vote
3answers
163 views
Is it a good idea to have a “master” password?
Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
-2
votes
3answers
147 views
What's the use of making users use digits, uppercase-lowercase combination password if the passwords are hashed?
Some websites, even the StackOverflow asks for atleast 1 digit, 1 uppercase character in the password so my question is does this really matter when the developer uses 1 way encryption algorithm to ...
3
votes
3answers
271 views
Hash Function Xor
For a hash function what is the best secure method, XOR or Concatenate:
h(data1 XOR data2 XOR data3 XOR data4) ? or use h(data1||data2||data3||data4)?
0
votes
2answers
275 views
How can I extract the MD5 hash of a password protected MS Office Word 2000 document?
AFAIK, the compound file format identifier is D0 CF 11 E0 A1 B1 1A E1, which is located in the offset 0 of the header, which has a length of exactly 512 bytes.
However that is not enough to get the ...
4
votes
2answers
812 views
openssl: recover key and IV by passphrase
A large amount of files were encrypted by
openssl enc -aes-256-cbc -pass pass:MYPASSWORD
Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
2
votes
7answers
396 views
Is it possible to detect password length from hash? Does doubling your password add more security?
Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
1
vote
3answers
320 views
Will SHA1 of Email Addresses Always be Unique?
We want to store data about a person without storing their email address, but we want to latter connect that person with their data upon them supplying their email address.
Storing a SHA1 of their ...
2
votes
2answers
167 views
In this example why do they hash a randomly generated piece of salt before hashing it with the password?
From here, in the code return substr(sha1(mt_rand()),0,22); what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append ...
0
votes
3answers
154 views
Why is it necessary to match the checksum of a download with another file provided by the same server? [duplicate]
Possible Duplicate:
Does hashing a file from an unsigned website give a false sense of security?
On many servers providing files for download, there is a file on which checksums are ...
0
votes
2answers
286 views
Tool for generating MD4 collisions
There are a lot of research papers available online that discuss vulnerabilities of MD4 algorithm, but I couldn't find any implementation of these.
Uptill now I have used tools like John the Ripper ...
2
votes
2answers
96 views
What's the point of using multiple checksum algorithm with “aide”?
In aide the author offers more than one hash algorithm to do the check-sum, why is that?
Aren't a single one, i.e sha512 enough for determining file changes? I believe these algorithms are all ...
1
vote
3answers
989 views
Is bcrypt better than scrypt [duplicate]
Possible Duplicate:
Do any security experts recommend bcrypt for password storage?
I'm no security expert and do not pretend to be that's why I'm asking here. I write many PHP based ...
1
vote
2answers
467 views
should i use urandom or openssl_random_pseudo_bytes?
I am developing a site in php 5.4 and i was wondering which is better to use to gen a random salt for password security?
$salt = sha1(openssl_random_pseudo_bytes(23));
or
$seed = '';
$a = ...
7
votes
7answers
206 views
Proving running code on a website is unchanged
Can it be proved to the user that the running code behind a website with security related code is the same as published?
I'm currently looking at a few new project ideas and one involves secure ...
1
vote
1answer
76 views
How big is the risk of hash fixed points/cycles?
It's established wisdom to hash password multiple times with a salt to increase the time it takes per brute force iteration. At the same time (unless the algorithm guarantees otherwise) there's a ...
8
votes
4answers
312 views
How to evaluate the strength of a hashing algorithm?
At work the hashing algorithm we use for passwords appears to be bespoke. Obviously that's a pretty bad idea, but the management don't seem bothered.
The algorithm always produces 20 character long ...
3
votes
2answers
116 views
Doesn't adding requirements to a password, such as must contain 2 digits, decrease the strength? [duplicate]
Possible Duplicate:
Doesn’t imposing a minimum password length make the password weaker by reducing the number of possible combinations?
Doesn't any constraints added to a password policy ...
2
votes
2answers
691 views
OpenSSH default/preferred ciphers, hash, etc for SSH2
When using OpenSSH server (sshd) and client (ssh), what are all of the default / program preferred ciphers, hash, etc. (security related) and their default options (such as key length)?
So, what are ...
197
votes
9answers
20k views
Is my developer's home-brew password security right or wrong, and why?
Our developer, let's call him 'Dave', insists on using a home-brew script for hashing passwords. See Dave's proposal below.
We have already researched and adopted an industry standard protocol using ...
