A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

2
votes
1answer
188 views

Reverse Engineer this basic Hash using known answer?

Little background: I forgot one of my CCTV accounts password, so used the admin account to create a new one. However I can't access the old one as it's not possible to change a user account password, ...
0
votes
1answer
81 views

Please help clarify password hashing - salted, multiple iterations of MD5 vs bcrypt/sha2, etc [duplicate]

I was reading an article about the Ars Technica hack here and had a couple of questions. The commenter said: "PHPass uses salted and iterated MD5 to hash passwords" My question is that if I were ...
0
votes
2answers
70 views

Separate database column for salt

Is it advisable to store the salt in a separate database column or should we concatenate it together with the password? Is there any difference? I have come across implementations of both types. ...
83
votes
6answers
28k views

Password Hashing add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
10
votes
1answer
493 views

Torrent “bad seed” attack by Sony, how does it work?

Sony recently saw a large amount of data stolen. In order to prevent the stolen data from being spread using torrents, they are doing what was called a bad seed attack. What is this attack? Is this a ...
2
votes
0answers
42 views

HMAC-SHA256 Transaction signing [closed]

Can rfc6238 be used for transaction signing by concatenating the random seed string with transaction details (such as amount and target account number) ? Could a transaction authorization 8-cipher OTP ...
1
vote
0answers
72 views

Passing the hash with metasploit and psexec not working - why? [closed]

I am currently doing a penetratiion test, and have captured a bunch of NTLM hashes via NBSN spoofing. An example (this is not taken from what I captured, and is random but the format is the same) ...
2
votes
2answers
434 views

PBKDF2: can the salt be known from the hash?

I understand that some KDFs bundle the salt with the output, such as bcrypt (modular crypt format). In PKCS5_PBKDF2_HMAC (specifically, looking at OpenSSL implementation) with a single iteration, is ...
-3
votes
1answer
69 views

Authentication protocol based on hash function [closed]

Is it possible that Alice can authenticate Bob without using any secret information except her password, i.e they don't share any thing else. If so, how can I authenticate Alice and ensure the ...
2
votes
1answer
320 views

TrueCrypt VS LUKS Bruteforce Resilience

I have been researching LUKS vs TrueCrypt topics -- my only concern is security, but most of the discussions I see focus around usability / interoperability . I know TrueCrypt has a bunch of nice ...
-1
votes
1answer
86 views

Why not use md5 auth mechanisms for IMAP over TLS?

I'm using Dovecot for IMAP connections. I've read a lot of tutorials on how to set up Dovecot, and a lot of them said to only allow: auth_mechanisms = plain login Why should I not allow *-md5 ...
2
votes
3answers
148 views

Are there any flaws in this two way cryptographic function?

I created a simple two way cryptographic function which allows you to encrypt a message and decrypt it with the same key. Here's how it works. Split the message into an array of 32-bit (or something ...
3
votes
1answer
108 views

Do I need a salt when hashing a randomly generated password?

I have passwords stored in my database that are very long, unique and generated by a CSPRNG. Do I need to use a salt before hashing them? My understanding is that usually you use a hash function in ...
31
votes
5answers
2k views

Password Storage - Self Encryption vs Hashing?

Self Encryption: Encrypting a password using the password itself (as a symmetric key). Basically, by doing this, I'll get random data as an output. Now, in order to retrieve the password from this ...
0
votes
1answer
80 views

PKI - Security concerns when changing a certificate hash algorithm

Suppose I want to change the hash algorithm used for a certificate signature (ex: SHA1 to SHA2). Is it better to revoke the previous certificate and issue a new one with expected hash algorithm ? Or ...
13
votes
6answers
3k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
24
votes
4answers
5k views

What is SHA-3 and why did we change it?

On the 2nd of October NIST decided that SHA-3 is the new standard hashing algorithm, does this mean we need to stop using SHA-2 as it is not secure? What is this SHA-3 anyway?
0
votes
0answers
54 views

Detection of pass the hash

I have researched about PTH Attacks but yet found any solid way detecting it in a network.is there a way to detect a pass the hash ? analysing the windows message from the dcs or something ?
1
vote
1answer
115 views

Algorithm to Transaction Data Signing

Transaction Data Signing I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device. What is the idea? The ...
7
votes
1answer
1k views

Identifying an unknown hash

During some of my research work I encountered an unknown hashed string. What I am curious about is the algorithm used to generate it. A factor that makes it interesting - the string contains an ...
0
votes
2answers
357 views

Native app, token authentication without login/password

I'm working on a always online mobile game (native android/iOS app with Unity) and i would like to be able to authenticate the player without requiring any login/password at the beginning. For those ...
17
votes
2answers
2k views

Methods for slowing down a hashing algorithm

I understand why a hashing algorithm should be slow but is the method that makes it slow important to the strength of the hash? Everything I've read says that the algorithm should be computationally ...
1
vote
1answer
178 views

What is the right way to implement Keyed Password Hashing?

As mentioned in this wonderful link, the way to get a PBKDF2 Hash of a user given password given a password (of course), a salt (generated Cryptographically Secure Random Number Generator. iteration ...
22
votes
4answers
3k views

How would you store a 4 digit pin code securely in the database?

I'm familiar with password hashing, using salts, bcrypt etc. But it doesn't seem like this would work to store a 4 digit pin code since the attacker could try all 10,000 combinations quite quickly. ...
5
votes
3answers
257 views

Are there any disadvantages to encrypting the password hash?

Is encrypting the password hash in database more secure than storing only the hash? Suppose we store encrypted SHA-256 result with AES instead of hash directly. Is this a good protection from a ...
1
vote
1answer
50 views

Using salt or secret for Hmac

I'm working on a web API. We are going to use Hmac256 for signature hashing. From what I can gather, the secret is a key used to initialize the hash algorithm (ie to generate a random number). The ...
1
vote
2answers
71 views

XOR-Cascade of weak hash secure?

I have following theoretical question: Let H(X) be a hash function which is considered as weak because collissions can be produced (e.g. SHA1, MD5). I wonder if following functions: H2(X) = H(H(X)) ...
6
votes
3answers
266 views

Calculating password hashes in the browser?

I just finally got into Keybase and was surprised to see this in the sign-up page: Shouldn't password stretching and hashing be done on the serverside, as we normally don't trust a client?
1
vote
2answers
71 views

bscrypt,scrypt v/s iterative SHA-x [duplicate]

Both bcrypt and scrypt hashing algorithms are designed to increase the resources required during the computation. Hashing passwords with these algorithms can be beneficial as it makes the task of an ...
1
vote
1answer
121 views

How are SHA1 and MD5 considered to not protect against collisions?

SHA1 and MD5 hash functions are considered to not protect against collisions while SHA2 is. Is it the size of the message digest that makes this or the algorithm itself? If it is based on the message ...
3
votes
1answer
45 views

Feeding PBKDF2 to SRP verifier creation

There is an older game that solely uses UDP to communicate, and I wanted to add password authentication to the game to facilitate things like experience points and rankings. To this end, I decided to ...
1
vote
2answers
83 views

Storing AES password for verification

I was wondering if such practice would be safe: I have a table that stores encrypted notes Every note has a data field and a password field When a password is entered, i want to select all notes, ...
2
votes
3answers
169 views

Can password_verify() be used to identify password after database breach?

I am a newbie to PHP and password hashing. I am following the instructions provided here to hash my user password before storing. My questions are: PHP recommends password_hash() method as a ...
1
vote
2answers
160 views

Stream/block cipher add a simple hash to guarantee integrity

The question is simple: Adding a hash to a message and then encrypt it using a stream cipher / block cipher. Why can't this guarantee integrity of the message upon decryption?
27
votes
2answers
4k views

How bad is it to truncate a hash?

I'm wondering how bad it is to truncate a SHA1 and only compare, say, the first 10/12 bytes, etc. I'm working with a fixed length of 8 bytes that I need to hash for uniqueness but store with the ...
131
votes
8answers
15k views

Why are salted hashes more secure?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...
-8
votes
1answer
168 views

Someone help me decode this [closed]

What type of hash is this? a9df6dcd35f4e7223ff3dd087abcc266 I can't find anything when I decrypt it. Please someone decrypt it
2
votes
1answer
224 views

How Windows Server 2008 Stores Local Users Passwords?

It is not clear to me how Windows Srver 2008 R8 stores local account passwords. Is there any salt added or just NT hash is computed and stored. The following article describes all the methods used by ...
2
votes
1answer
216 views

HMAC secret key for securing communication - how to keep private on DB

I have a mobile app that communicates to server over HTTPS. To authenticate the client and to make sure its who I believe it is, I return upon successful signup (apart from the username) a secret API ...
9
votes
2answers
2k views

How does Google not care about “spaces” in Application-specific passwords?

I have recently setup "2-step verification" for my Google account. One of the features is the ability to create "Application-specific passwords " for devices that do not support the 2 step process. ...
1
vote
2answers
153 views

Why is the brute force search time for hashing algorithms 2^(num_bits / 2)?

I noticed that the brute force times (the time it takes to find a message that hashes to a given hash) of various hashing algorithms seems to be 2^(num_bits / 2). For example, people say that brute ...
1
vote
3answers
125 views

Site allows both Partial and Complete password authentication; do they have my password in plain text? [duplicate]

My bank provides online banking facility like most of the banks these days. On the web they have Partial Password Authentication. Although I don't really believe in PPA providing extra security but ...
44
votes
8answers
6k views

Do bad passwords produce bad salted hashes?

When you have a password stored in a database that has been strongly hashed and salted does it really matter if the underlying user password is weak? If you setup features like limiting login ...
3
votes
2answers
126 views

Similarity comparisons with hashed passwords possible?

At a company I worked at, I had to change my password every 90 days and I could only reuse a password after 8 iterations. This no-reusal included passwords being too similar to the old one, e.g. when ...
8
votes
6answers
977 views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
20
votes
6answers
2k views

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

I'm cross posting this question from Programmers.SE because I think it's equally on-topic here and would like to pose the question to this community as well. This seems like a programming question ...
3
votes
1answer
333 views

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

This is going to get long, so prepare. Basis of the question is, Do all these steps improve security, or am I completely overthinking the problem? Are my assumptions/thought process valid? We all ...
1
vote
1answer
61 views

Multi hash security [duplicate]

Is md5(sha1(pass)) more secure than md5(pass)? For example in case of sqli when attacker cant get our hashing schema, brute force or dictionary attack would be much less efficient. Am i right or is it ...
-2
votes
2answers
75 views

Strength of WPA passwords

How long would it take to crack an 8 letter (latin alphabet, lowercase) password of a WPA PSK network? Is it in reach of a single PC running hashCat?
20
votes
9answers
1k views

Is a simple, but very long password a good password?

Is a password like wwwwwwwwwwwwwwwwwwwwwwwww9 (25x 'w' and a number) secure? It would be easy to remember.