A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

0
votes
1answer
87 views

Possible to take hash from know result and algorithm?

I am trying to build a casino site in PHP where users can play roulette. I found this algorithm that I want to use to "roll" numbers: <?php $secret = '...
0
votes
2answers
164 views

store passwords as one-way-hash, or just use it as an AES key?

I want to store some data so the only one who'll be able to access it is the user itself. Here is my idea: when user registers, his password will be hashed in SHA256 (so it'll fit as an AES key), and ...
1
vote
1answer
113 views

How to implement iterations when hashing passwords?

To securely hash passwords, algorithms such as PBKDF2 do many iterations of a common hash such as SHA1. Are there certain ways that these iterations need to be done to be safe? In particular, from ...
1
vote
0answers
20 views

How do atom's apm and npm verify package integrity?

Are there built in verification methods to make sure the packages contain the correct code? Do they use a hash of some sort?
1
vote
1answer
100 views

How does JDBC send passwords to the server?

I am really curious about how JDBC sends passwords to the server. While I understand that is simply an API and it depends on the implementation, are they usually hashed and then sent to server? If I ...
1
vote
1answer
37 views

Possible number of collisions in a hashing function with constant message size

Jumping to conclusions from my question, can we predict possible number of collisions for a given message in a given hashing algorithm. Say I am using SHA-1 which outputs 160 characters string, and ...
-1
votes
1answer
58 views

Shouldn't multiple images always exist even in most powerful hashing algorithm?

I have a confusion in mind that since in hashing we transform a large string into a smaller fixed size string, so its unlikely that any large string has a unique hash. There had to be collisions and ...
2
votes
0answers
72 views

How exactly does “Apache Shiro's” hashing work when using a Desktop-Client

I was looking at this question How does storing hash passwords work? and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. ...
13
votes
1answer
3k views

Should I hash my passwords even if I am only allowed to generate limited traffic?

At this moment I'm busy working on an webapp with a friend of mine. The main problem we have is that we are only allowed to generate 50 GB a month in datatraffic. My question is: Does hashing the ...
-5
votes
1answer
96 views

Time to break SHA-512 [closed]

From http://stackoverflow.com/questions/6776050/how-long-to-brute-force-a-salted-sha-512-hash-salt-provided, to break SHA-512 with brute force strategy, it require 3,17 * 10^64 years. It is almost ...
1
vote
2answers
451 views

How to store the access token / password reset token in the database?

I have an access code that is sent to users so that they can access the site in one-click. From terms of access it's very similar to the password reset url, so I assume the same assumptions apply. E....
6
votes
2answers
813 views

Is it safe to publish something encrypted with a password if you make it insanely difficult to crack?

Let's say you have a very important private key that you don't want to lose. You think of posting it to http://pastebin.com/ but then relize that elimanates the point. So you think of encrypting with ...
15
votes
2answers
1k views

What's the difference between a hashed and an encrypted password?

Alright, so I know this may sound dumb, but I'm having a hard time understanding what an encryption would be since it's different from a hash. I've read up on it, but I'm still not quite sure. So, I ...
35
votes
8answers
4k views

Find matching phone numbers without actually knowing them

We have a mobile app that, given two users, needs to let them see what common contacts they have based on their phone numbers. How can we do this in a cryptographically secure way and respecting the ...
0
votes
2answers
97 views

How do data breaches of account login information end up in plaintext?

For example, see this story. Am I missing something here? Are the login details actually still encrypted? I don't understand how it is possible for a data breach of what I assume is encrypted ...
3
votes
2answers
98 views

For high entropy credentials, is SHA256 hashing good enough?

Let's say I've got a database of high-entropy credentials (e.g. 256-bit random values) used as API keys by clients. I'd like to hash them in my database so that a database compromise doesn't allow an ...
1
vote
1answer
59 views

Value of hash in digital signature

I'm hashing using SHA 256 and signing a payload with a private key.The payload does not contain any password and would be HTTP(S) POSTed to server side. The payload contains some dynamic and constant ...
0
votes
2answers
58 views

How to properly hash a key? big vs small digest

We have to roll (decommission) database access keys often, but it's important to know which key each system is using in order to avoid removing a key in use thus creating unavailability. We want each ...
1
vote
0answers
52 views

Which is the correct algorithm while checksumming a portion of code?

As part of my research, I came across a technique in a paper which applies checksumming on a portion of code. I want to implement it. Here is the research paper which talks about the checksumming ...
2
votes
1answer
123 views

What is the difference between a digital signature and whole message encryption?

I am newbie in information security I am trying to understand the difference between a digital signature and encryption of a message. Lets consider simple example of email message. I understand how ...
7
votes
1answer
127 views

What are the recommended scrypt cost factors for 2016?

I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?
0
votes
1answer
98 views

Is `/dev/urandom` secure to generate a salt on a Virtual Machine?

I've read the new password_hash() function from PHP uses /dev/urandom to generate a secure salt, however this assumes some noise from device drivers. Is possible that /dev/urandom is not so random ...
0
votes
1answer
41 views

Hashing and signing partial data in payload

I'm hashing and signing part of a payload prior to HTTP Posting from a mobile device to server side. The payload contains of about 7 data elements and only 3 of them are hashed/signed using a private ...
6
votes
4answers
1k views

Does quick denial tell that you passwords are stored in plain text?

Say you are using a website and incorrectly enter your password. The website then "instantly" pops ups with an "incorrect username/password" message. Would it be safe to infer that the website is ...
3
votes
1answer
217 views

How to detect mimikatz usage on LAN

My boss is has made it clear that we need better ways of detecting mimikatz usage on the network- and I would agree. In place already for detection is suricata/ET PRO rule set on a couple of taps. ...
1
vote
2answers
78 views

Is it possible to find the salt?

I have this PHP code with me : $auth = md5($username.$password.$salt); I have a dummy value : $username = user $password = password And I also have the resulting MD5 Hash : ...
0
votes
3answers
98 views

when to use encoding over hashing?

If encoding is used for integrity someone can tamper it across the network because it is based on some publicly known scheme. When do you use encoding and when do you use hashing for preserving the ...
-8
votes
4answers
171 views

Why shouldn't I store passwords in plaintext? [closed]

Why is it so important not to save passwords in plaintext? I think it is the same issue like authorizing a user on a RESTful webservice, where most developers claim: "Don't send your security token ...
1
vote
1answer
75 views

Powershell and cached credentials

In my environment we have powershell remoting off- I get around this using 2 hop scripts, packages(exe -no creds are stored in code- local privs only), and iwmi. I never pass creds to the endpoint, ...
26
votes
5answers
4k views

How does storing hash passwords work? [duplicate]

In usual network applications, that employ password hashing, is the user password hashed on client side before sending it to the server, or is it sent without hashing as encryption of plain text ...
1
vote
0answers
31 views

Change NTLM hash in memory on the lock screen?

Is there a way to change the ntlm hash in memory to bypass Windows login? For example, I have the NTLM hash of a Windows machine and I have physical access. Is possible to write the NTLM hash in ...
1
vote
1answer
31 views

Passing a hash of a secret to a server instead of the plain text

Instead of passing an authentication token or api key in an http header to a server in the plain text, what if I calculated its hash and passed the hash? This way even if a adversary intercepts the ...
5
votes
2answers
105 views

Idea for an encrypted pastebin NON-web application

I have an idea for an app that might be useful (though if it isn't, I've still learned in the process, which is what matters). There are a bunch of encrypted pastebin web apps out there (e.g. defuse....
3
votes
2answers
92 views

Incrementing Work-Factor of Hash Functions Over Time

For a long time hash functions have required a work-factor in order to keep the operation "slow" enough to protect individual passwords in the case of a database leak. Bcrypt and PBKDF2 being notable ...
1
vote
2answers
68 views

Upgrading security of hashed passwords [duplicate]

Let's say we have a database with usernames and passwords, where the passwords are naively secured using a single round of SHA-1 (such as was kinda best practice a number of years ago). Now, let's ...
3
votes
2answers
124 views

What scenario are 'extra' strong passwords and hashing algorithms actually protecting against?

Note: I completely understand the need for strong passwords & I understand that there is an issue of speed with hashing. I am just interested in better understanding the actual negative impact of ...
2
votes
0answers
35 views

The optimal settings of Winrtgen GIU

I'm working with Winrtgen GIU on windows, but I can't fix the right settings to create a rainbow table for a: password length=1-7 Charset=alpha numeric all space What are the ideal values to put in ...
3
votes
4answers
154 views

Is knowing the salt a problem?

I understand that adding a salt would thwart the use of rainbow tables. I don't understand the time it would take to create a rainbow table for a certain salt and of course this is dependent on the ...
3
votes
1answer
65 views

Is appending plaintext to salt equally safe as appending salt to plaintext

Is using hash(salt, plaintext) equally secure as using hash(plaintext, salt), i.e. can the plain text be appended to salt in place of appending salt to the plain text. Why or Why not? What kind of ...
3
votes
1answer
121 views

Two-phase anonymization

EDIT: [N.B: I fully replaced the original question which was not a very good statement of the problem (see comments) with a more apt one.] I have records that contain - among other things - the ...
3
votes
5answers
639 views

Why can passwords be used to encrypt data, but are less strong for authentication?

Encryption software is often password based. Even if the adversary gets your computer they can't get the data without knowing the password, and bruteforcing is infeasible. Websites use passwords to ...
3
votes
2answers
253 views

Is signing android apk file with SHA1 digest secure enough?

Google command line example for signing apk files: $ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name source: http://developer....
6
votes
2answers
157 views

Is it good to store passwords in a separate table/database and manage them in a separate process?

I'm quite a newbie at systems architecture and security so I just want to check that this plan makes sense. I'm building a web app and I need to store a password for each user. I've already read ...
-4
votes
1answer
73 views

Sum two SHA256 to get a SHA512 [closed]

I see this code in a web game SHA512(SeedServer + "|" + SeedUser) and I'm trying to reproduce this hash. I tried in PHP: <?php echo hash('SHA512', '...
2
votes
2answers
121 views

Where to store a pepper?

Assuming you're using a pepper in your password hashing, where should it be stored? I know you shouldn't store it in the database since it can easily be found there during a dump and the idea is to ...
81
votes
10answers
10k views

Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?

I always hear "A long password is good, a longer password is better". But is there such a thing as a "Password is so long it is becoming unsafe" or "Password is long enough, making it longer won't ...
4
votes
1answer
102 views

Is it possible to use parallelism when computing a key derivation function for a single password/key?

Suppose I have an AES-256 encrypted file, and I want to derive the key using PBKDF2 and a given salt with a large number of rounds (say 1 million), but I'm limited by user tolerance for UI lag when ...
3
votes
1answer
169 views

MD5 Algorithm: A basic explanation of the process

Could anyone please explain the basic idea and steps involved in the MD5 algorithm? I tried reading it on the web (Wikipedia etc.), but it was just too high level for me. So, can someone explain the ...
0
votes
0answers
142 views

HMAC Token - Check Logic

I have a situation where I need a token that provides authentication. The common HMAC procedure I found is: Get Some key using login credentials Create Message, append key and other message data (...
6
votes
2answers
1k views

Can I use SHA-512 hash as AES key?

I want to combine hashing and encryption for better security. So can I use a hash key generated from SHA-512 as a key in AES. For example, I have a password "secret", I calculate SHA-512 hash for it ...