A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

0
votes
3answers
113 views

Is is necessary to encrypt the message digest?

In symmetric key settings, in order to provide the message integrity, we compute the hash of the message. The message along with the message digest is then encrypted. Is it necessary to encrypt the ...
10
votes
2answers
237 views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
-1
votes
1answer
676 views

How do I hash a password in C#? [duplicate]

I assume that the best way to handle passwords for a website is I create a hash of the password and save that hash in my database. Then when someone tries to login, I do a hash of the password they ...
25
votes
6answers
21k views

Most secure password hash algorithm(s)?

What is/are currently the most cryptographically secure hashing algorithm(s)? (available in PHP) Speed is irrelevant, because I'm iterating the hash over a fixed time (rather than a fixed number of ...
7
votes
4answers
1k views

Gold Standard for password hashing

I've developing a web application that will be dealing with highly sensitive information and I want to ensure the hashing of passwords is gold standard. Ideally I'd go for per-user salted SHA512 ...
1
vote
2answers
135 views

Search on hashed data

We have a request to encrypt customer personal data (e-mail, address etc.) We use MySQL which does not have any TDE like MS SQL or Oracle. So along with encrypting data we need to preserve ...
0
votes
3answers
2k views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
2
votes
3answers
131 views

Is it ever safe to publish hashed data?

I'm having a friendly debate with someone who thinks that a website can safely make public sensitive data about it's users as long as that data is hashed (don't ask why, it's a long and hypothetical ...
0
votes
2answers
44 views

Protect against malicious client with key derivation function (PBKDF2)?

Consider a protocol that allows clients to retrieve XML "forms" from a server. Forms are identified by a unique, randomly generated form ID that is embedded in the form. Clients fill out the form and ...
3
votes
2answers
169 views

How safe is to secure sensitive content by URL with MD5 hash and no other authorization?

Suppose we have website that use MD5 hash in URL like this: http://somewebsite.com/XXX/ where XXX is MD5 hash. Content of this website may have sensitive information like transaction details with ...
0
votes
1answer
78 views

Secure log in without sending plain test to server

I know this question asked so many times, but here I am again with it. I am working on an application in which I need to log-in users but the question is it is not a good Idea to send user credentials ...
3
votes
2answers
182 views

Is there a strong reason to salt and hash passwords when password reuse is not an issue?

I am dealing with a system (in development) that uses randomly generated (not user provided), unique, strings to authenticate services that will consuming an API. Right now, these strings are stored ...
7
votes
4answers
1k views

Why secure encrypted data consistency by strong hashing?

Consider the SSH protocol: the SSH packet is like [data, SHA1(data)]. The packet is entirely encrypted by a block cipher. The question is, why do we need a strong hash to protect the packet ...
13
votes
3answers
1k views

Trying to understand why signatures in root certs “are not used”?

Taken from here: Don't worry if the root certificate uses SHA1; signatures on roots are not used (and Chrome won't warn about them. Why are the signatures not used? Are not root certificates ...
0
votes
2answers
66 views

Is my Password Hashing Secure or not?

I have recently created a code for hashing password. Can you please give your advice over the security of my code? The function takes a password, then converts it to a number. #include <string> ...
0
votes
1answer
103 views

Idea for an algorithm to authenticate users with zero-knowledge-proof [need thoughts/review]

I have an idea for an algorithm. I don't know if I made any mistakes and need some extra thoughts/peer review on it. This would work as an (almost)zero knowledge proof for sending passwords that can ...
4
votes
1answer
130 views

Using random number to salt passwords

in a project I have, I'm salting passwords with 3 salts at the moment... Static salt - hard-coded into the source-code. Randomly generated salt (using a function designed for generating password ...
0
votes
2answers
70 views

Authenticate User Salted Hash Without Username

I've got a page with a login system where you type your username and password, the salted hash gets pulled down from the database depending on the username ... SELECT hash FROM db WHERE username = ? ...
-2
votes
1answer
145 views

What hash version is implemented on ThePirateBay.se? SHA-1 or MDA-5? [closed]

I downloaded a File Checksum Utility executable file from Microsoft. This tool is for checking the hash of a file. I'm wondering what is the version of the "Info Hash" section on the torrent site ...
-2
votes
1answer
86 views

client side and server side hash password [duplicate]

Another question about client or server side password hashing, I know. After reading many other post about this topic I'm still a little confused and not completely sure what is the best, because I ...
3
votes
2answers
342 views

Why is a CSR hashed?

What are the use cases for defining something other than the default SHA1 hash in a CSR? Is it to protect the digital signature, public/private keys? What is it protecting exactly?
6
votes
1answer
489 views

What is “c/s” in context of hash cracking?

I was reading hashcat's About page, and the stats are listed in terms of c/s....is that "Cracks per seconds"....the 'c' part seems wrong, I'm just guessing. What is 'c'?
0
votes
1answer
67 views

Good way to make a secure token for logged out users

I work for a firm that has a marketplace on the web. We want to make a link with a token that stops an ad on the marketplace without the user being logged in. Someone suggested that we make a token ...
0
votes
1answer
89 views

encrypted lookup-keys for key-value store

I'd like to use a key-value store (cassandra, redis, ...), but I don't trust the server. The clients have a shared secret, and I'm using that to encrypt the stored values. But what is the proper way ...
2
votes
4answers
545 views

Is hashing the hash considered an extra level of security [duplicate]

As in md5(md5(md5(x)))... I can remember coming across that in some piece of code. If the attacker can somehow reverse md5(md5(md5(x))) into md5(md5(x)) then he certainly can reverse md5(md5(x)) into ...
0
votes
2answers
119 views

Do hashes repeat themselves?

I am not sure how hashing works exactly, all I know it is impossible to reverse it. All hash types have X amount of characters in them while the phrases and made up words can have an infinite quantity ...
0
votes
2answers
220 views

Is this hash function safe?

Below is the hash function implementation of the roguewave library. It returns a 32 bit hash. The core operation is A = B ^ ((C << 5) | (C >> 27)). Is this hash safe to use as a password check ...
1
vote
4answers
274 views

Should BCRYPT be used for client-side password hashing

I am concerned about the use of bcrypt for client-side password generation. I am developing a password generation function to be used client-side, similar to PwdHash and PasswordMaker. Much has been ...
-2
votes
1answer
256 views

What type of hash is that [closed]

Hey do you guys know the algorithm used to generate this hash? 6874747a3b202063733437373676342f766c2f6e6520753933313538343931206175646960732039‌​353861383a3a36663836392f6e7a3325313638 It's ...
3
votes
1answer
145 views

How to check for presence of LM hashes in local SAM

To get rid of LM hashes in local SAM databases, one can rely on the famous NoLMHash domain GPO, which instructs clients not to store password hashes with the LM algorithm locally ("Do not store LAN ...
2
votes
3answers
253 views

Does figuring out what one password hashes to allow you to crack all identical passwords?

Forgive me, as I am very new to cryptography, but it seems interesting, and I have a question. I'll state my beliefs and please feel free to correct me on the aspects that I'm mistaken so i can ...
0
votes
1answer
87 views

What multiplier to use when calculating the average time to crack passwords with a given entropy?

Suppose that we have a process that generates passwords with entropy E. I'd like to compute the average time it would take for a brute-force attack to crack an MD5-hashed instance of such a password. ...
-1
votes
1answer
71 views

Can HMAC leak the password? [duplicate]

Imaging the following pseudo-code: h = hash(sha512) h.input(password) h.input(message) send h, message to client If the user has the hash and the message, and the only missing variable is the ...
18
votes
4answers
2k views

Should I use own constants when using well known hashing algorithms?

I understand that it is important to use well known and well tested hashing algorithms instead of designing my own. For such there often are reference implementations available, which initialize the ...
2
votes
1answer
163 views

Is encrypting something more than once safer than hashing more than once?

I am aware of the implications that hashing something more than once correctly will increase the security of a system, but doing it incorrectly will decrease it, as noted here and on various other ...
2
votes
4answers
713 views

Using last characters of hash as salt [duplicate]

In a recent discussion somebody mentioned the following hashing scheme: passHash = sha256(password) saltedHash = sha256(passHash+passHash.substr(-10) finalHash = sha256(secret+saltedHash) The ...
21
votes
2answers
6k views

What is the difference between a Hash Function and a Cryptographic Hash Function?

I mean, is it just a matter of "how difficult is it to reverse the function with the current technology"? Or is there a mathematical concept or property that makes them different? If it is a matter ...
-2
votes
2answers
61 views

Identifying/decrypting hashed/encrypted data [closed]

This weekend I took part in an security challenge. I had great fun doing it but i found a huge gap in my knowledge that I'm really keen to fill and hope someone here can help get me pointing in the ...
1
vote
2answers
127 views

Difference between OS X md5 and gnu md5sum

I have installed the "md5sum" utility on my Mac and there was also a "md5" binary pre-installed in /sbin. My problem and question is this: "Isn't MD5 a standard algorithm?" Because I get different ...
1
vote
2answers
359 views

Are newly-generated recovery passwords sent to me via email hashed? [duplicate]

If a company sends me a new password via SMS/email because I clicked "forgot my password." Does that mean the company is not actually hashing my passwords?
-1
votes
4answers
75 views

Confidentiality of file hashes

Context: I have a directory full of sensitive company files. I want to compare these files with a colleague at a remote location, without the need for a secure connection. Is it safe for me to ...
0
votes
4answers
237 views

How does a hashing function always return the same length hash?

I've been looking into what hashing functions are, what they do, &c. I was just wondering: how does a hashing function always return the same length hash? How does hashing work? does not explain ...
-1
votes
3answers
79 views

What does one call the strategy of using “pre-password transforms” as passwords?

Suppose that instead of using, say, Google, let me in! as my Google password, I used some consistent transform of this string, say ZWE1NjMyNm? What search keywords would be helpful to search for ...
3
votes
1answer
141 views

A pair of 'self-signing' hashing functions? [closed]

Does a pair of (hashing) functions for which where neither g(x) nor f(x) are constants exists?
4
votes
5answers
648 views

When hashing passwords, is it okay to store the algorithm used right there in the database?

Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
36
votes
5answers
9k views

How does hashing work?

I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it ...
2
votes
2answers
74 views

Should security phrases be hashed?

I didn't think of this before but today I just realised that in soke sites, pw recovery is possible if you know the answers to security questions like What is your mother's maiden name? In this ...
0
votes
3answers
139 views

“Remember me” cookies - did I implement them securely?

I am currently working on a pet project website and I want to implement the "remember me" feature for logins and wanted to know if my procedure is secure. The authentication process basically goes ...
0
votes
3answers
145 views

Did the “Malicious SHA-1” technique enable the NSA to insert a backdoor into SHA-1?

SHA-1 was standardized by the NSA. It appears to be possible to choose the constants in such a way that collisions can be derived easily. Yet, it is not easily possible to discover that the constants ...
0
votes
2answers
104 views

Simplest way of hashing a password with multiple different hash algorithms [closed]

I have a list of plaintext passwords that I would like to hash with various different hash algorithms (for educational purposes). As a minimum I would like to obtain hashes under MD5, SHA1, SHA256, ...