A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

23
votes
4answers
4k views

Do I have to hash users' IP addresses when I log them?

I have read a lot of users saying that you have to hash IP addresses - and a lot of others who say I don't have to because it is not private information. I use IP addresses for identifying users, ...
0
votes
2answers
69 views

Is it safe to use a derivative of a password as a salt

I know for a fact that salts are an important part of storing a password securely in a database. Most people store the password hash, and the salt that was used for it. This, I have learned, isn't ...
-1
votes
5answers
624 views

What if I develop my own hash algorithm to create strong passwords from easy ones?

I came up with this idea but I cant figure out if it's good or bad, maybe you can help. My goal is: I want to create extremely strong passwords for my main accounts (gmail, skype and so on). I want to ...
3
votes
2answers
118 views

John the Ripper not identifying a password contained in the username?

I have uploaded a screenshot of what exactly is going on, here: http://i.imgur.com/bJSv7C8.png I can see that single-crack mode includes a rule that looks at the username, and "slices" it to identify ...
-1
votes
1answer
310 views

Which PHP encryption method is most incidentally-secure?

just started researching on the latest PHP encryption methods, I've found out my favorite algorithms are compromised. MD5 is no good, SHA-1 has "found flaws", SHA-512 isn't "meant for passwords", ...
11
votes
4answers
2k views

Is there a length beyond which increasing password length provides no additional security?

Assuming that the password is stored hashed and salted, and that it is a string of random characters, is there a point where adding to password length doesn't add security? Since the hash will have a ...
20
votes
5answers
3k views

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...
302
votes
4answers
91k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
4
votes
2answers
70 views

What's the best way to transform sensitive account numbers

I work on a web application that manages information about transmission setups and processes client transmission statistics to generate billing charges for the services used by these clients. The team ...
9
votes
2answers
2k views

“Official statement” on php.net : CRYPT_BLOWFISH is strongest hash algorithm. Why?

First: I asked this question on stackoverflow and was kindly asked to post this here again. See the original question here. According to the [early] doc pages of the new PHP 5.5 password ...
3
votes
1answer
207 views

Improving magnetic stripe card security with a “magnetic noise” hash?

I was reading the wiki on magnetic stripe cards when I stumbled across this sentence: "Magnetic stripe cloning can be detected by the implementation of magnetic card reader heads and firmware that can ...
1
vote
1answer
52 views

Identifying hash format caputred via Metasploit

When I use the nbns_repsonde module in metasploit, and set it to write captured responses to a file in the john format, I get a file with lines such as this: ...
0
votes
0answers
15 views

Is it possible to pass the hash with a hash captured from spoofing NBNS responses?

I know that it is possible to use a hash obtained from the Windows SAM in a pass the hash attack, simply setting the hash for the SMBPass paramter for various modules in metasploit. Can a hash ...
0
votes
1answer
71 views

PHP: Save e-mail address hashed or plain [duplicate]

I've been wondering about something, is it more secure to store an encrypted (hashed with password_hash) email address in the database, or just as plain text? I've google'd this matter and saw that ...
29
votes
11answers
1k views

Does hashing a file from an unsigned website give a false sense of security?

Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
2
votes
1answer
209 views

Reverse Engineer this basic Hash using known answer?

Little background: I forgot one of my CCTV accounts password, so used the admin account to create a new one. However I can't access the old one as it's not possible to change a user account password, ...
0
votes
1answer
87 views

Please help clarify password hashing - salted, multiple iterations of MD5 vs bcrypt/sha2, etc [duplicate]

I was reading an article about the Ars Technica hack here and had a couple of questions. The commenter said: "PHPass uses salted and iterated MD5 to hash passwords" My question is that if I were ...
0
votes
2answers
75 views

Separate database column for salt

Is it advisable to store the salt in a separate database column or should we concatenate it together with the password? Is there any difference? I have come across implementations of both types. ...
10
votes
1answer
531 views

Torrent “bad seed” attack by Sony, how does it work?

Sony recently saw a large amount of data stolen. In order to prevent the stolen data from being spread using torrents, they are doing what was called a bad seed attack. What is this attack? Is this a ...
2
votes
0answers
48 views

HMAC-SHA256 Transaction signing [closed]

Can rfc6238 be used for transaction signing by concatenating the random seed string with transaction details (such as amount and target account number) ? Could a transaction authorization 8-cipher OTP ...
1
vote
0answers
82 views

Passing the hash with metasploit and psexec not working - why? [closed]

I am currently doing a penetratiion test, and have captured a bunch of NTLM hashes via NBSN spoofing. An example (this is not taken from what I captured, and is random but the format is the same) ...
2
votes
2answers
457 views

PBKDF2: can the salt be known from the hash?

I understand that some KDFs bundle the salt with the output, such as bcrypt (modular crypt format). In PKCS5_PBKDF2_HMAC (specifically, looking at OpenSSL implementation) with a single iteration, is ...
-3
votes
1answer
75 views

Authentication protocol based on hash function [closed]

Is it possible that Alice can authenticate Bob without using any secret information except her password, i.e they don't share any thing else. If so, how can I authenticate Alice and ensure the ...
2
votes
1answer
435 views

TrueCrypt VS LUKS Bruteforce Resilience

I have been researching LUKS vs TrueCrypt topics -- my only concern is security, but most of the discussions I see focus around usability / interoperability . I know TrueCrypt has a bunch of nice ...
-1
votes
1answer
104 views

Why not use md5 auth mechanisms for IMAP over TLS?

I'm using Dovecot for IMAP connections. I've read a lot of tutorials on how to set up Dovecot, and a lot of them said to only allow: auth_mechanisms = plain login Why should I not allow *-md5 ...
2
votes
3answers
155 views

Are there any flaws in this two way cryptographic function?

I created a simple two way cryptographic function which allows you to encrypt a message and decrypt it with the same key. Here's how it works. Split the message into an array of 32-bit (or something ...
3
votes
1answer
119 views

Do I need a salt when hashing a randomly generated password?

I have passwords stored in my database that are very long, unique and generated by a CSPRNG. Do I need to use a salt before hashing them? My understanding is that usually you use a hash function in ...
31
votes
5answers
2k views

Password Storage - Self Encryption vs Hashing?

Self Encryption: Encrypting a password using the password itself (as a symmetric key). Basically, by doing this, I'll get random data as an output. Now, in order to retrieve the password from this ...
0
votes
1answer
89 views

PKI - Security concerns when changing a certificate hash algorithm

Suppose I want to change the hash algorithm used for a certificate signature (ex: SHA1 to SHA2). Is it better to revoke the previous certificate and issue a new one with expected hash algorithm ? Or ...
13
votes
6answers
3k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
24
votes
4answers
5k views

What is SHA-3 and why did we change it?

On the 2nd of October NIST decided that SHA-3 is the new standard hashing algorithm, does this mean we need to stop using SHA-2 as it is not secure? What is this SHA-3 anyway?
0
votes
0answers
58 views

Detection of pass the hash

I have researched about PTH Attacks but yet found any solid way detecting it in a network.is there a way to detect a pass the hash ? analysing the windows message from the dcs or something ?
1
vote
1answer
120 views

Algorithm to Transaction Data Signing

Transaction Data Signing I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device. What is the idea? The ...
7
votes
1answer
1k views

Identifying an unknown hash

During some of my research work I encountered an unknown hashed string. What I am curious about is the algorithm used to generate it. A factor that makes it interesting - the string contains an ...
0
votes
2answers
401 views

Native app, token authentication without login/password

I'm working on a always online mobile game (native android/iOS app with Unity) and i would like to be able to authenticate the player without requiring any login/password at the beginning. For those ...
17
votes
2answers
2k views

Methods for slowing down a hashing algorithm

I understand why a hashing algorithm should be slow but is the method that makes it slow important to the strength of the hash? Everything I've read says that the algorithm should be computationally ...
1
vote
1answer
210 views

What is the right way to implement Keyed Password Hashing?

As mentioned in this wonderful link, the way to get a PBKDF2 Hash of a user given password given a password (of course), a salt (generated Cryptographically Secure Random Number Generator. iteration ...
22
votes
4answers
3k views

How would you store a 4 digit pin code securely in the database?

I'm familiar with password hashing, using salts, bcrypt etc. But it doesn't seem like this would work to store a 4 digit pin code since the attacker could try all 10,000 combinations quite quickly. ...
5
votes
3answers
289 views

Are there any disadvantages to encrypting the password hash?

Is encrypting the password hash in database more secure than storing only the hash? Suppose we store encrypted SHA-256 result with AES instead of hash directly. Is this a good protection from a ...
1
vote
1answer
55 views

Using salt or secret for Hmac

I'm working on a web API. We are going to use Hmac256 for signature hashing. From what I can gather, the secret is a key used to initialize the hash algorithm (ie to generate a random number). The ...
1
vote
2answers
76 views

XOR-Cascade of weak hash secure?

I have following theoretical question: Let H(X) be a hash function which is considered as weak because collissions can be produced (e.g. SHA1, MD5). I wonder if following functions: H2(X) = H(H(X)) ...
6
votes
3answers
271 views

Calculating password hashes in the browser?

I just finally got into Keybase and was surprised to see this in the sign-up page: Shouldn't password stretching and hashing be done on the serverside, as we normally don't trust a client?
1
vote
2answers
80 views

bscrypt,scrypt v/s iterative SHA-x [duplicate]

Both bcrypt and scrypt hashing algorithms are designed to increase the resources required during the computation. Hashing passwords with these algorithms can be beneficial as it makes the task of an ...
1
vote
1answer
129 views

How are SHA1 and MD5 considered to not protect against collisions?

SHA1 and MD5 hash functions are considered to not protect against collisions while SHA2 is. Is it the size of the message digest that makes this or the algorithm itself? If it is based on the message ...
3
votes
1answer
57 views

Feeding PBKDF2 to SRP verifier creation

There is an older game that solely uses UDP to communicate, and I wanted to add password authentication to the game to facilitate things like experience points and rankings. To this end, I decided to ...
1
vote
2answers
85 views

Storing AES password for verification

I was wondering if such practice would be safe: I have a table that stores encrypted notes Every note has a data field and a password field When a password is entered, i want to select all notes, ...
2
votes
3answers
220 views

Can password_verify() be used to identify password after database breach?

I am a newbie to PHP and password hashing. I am following the instructions provided here to hash my user password before storing. My questions are: PHP recommends password_hash() method as a ...
1
vote
2answers
165 views

Stream/block cipher add a simple hash to guarantee integrity

The question is simple: Adding a hash to a message and then encrypt it using a stream cipher / block cipher. Why can't this guarantee integrity of the message upon decryption?
27
votes
2answers
4k views

How bad is it to truncate a hash?

I'm wondering how bad it is to truncate a SHA1 and only compare, say, the first 10/12 bytes, etc. I'm working with a fixed length of 8 bytes that I need to hash for uniqueness but store with the ...
135
votes
8answers
16k views

Why are salted hashes more secure?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...