A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

1
vote
2answers
119 views

Is it possible to crack hash with known salt? If yes how?

Hello folks, I was wondering , if the salt in the hash is known to us,then is it possible to crack to extract the password from the hash? If Yes, How?
2
votes
3answers
142 views

Can I initially hash passwords with SHA instead of hashing them with bcrypt to decouple requests from slow crypto functions?

I'm using bcrypt for some web service requests that hash multiple passwords. The problem is that these web service requests can take minutes to complete due to bcrypt. Not very user friendly. My ...
2
votes
5answers
167 views

Does publishing the md5sum of a private key compromise the private key in any meaningful way?

If I have a 4096 DSA private key used for signing binaries, and I want to ensure that a partner has an identical server using the same private key, can I send the md5sum of the private keys over an ...
3
votes
5answers
3k views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesnt even have support for SHA or other algorithms. But I can think of quite a few advantages, ...
19
votes
3answers
3k views

Why are MD5 and SHA-1 still used for checksums and certificates if they are called broken?

I was just reading about SSL/TLS stuff, and according to this site (which is rated as A by Qualys SSL Labs), MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And yet, I noticed ...
2
votes
1answer
134 views

What is the best way to store passwords in OpenLDAP?

I would like to store user credentials in an OpenLDAP or similar directory server. A lot of online commentary about storing passwords in modern contexts recommends using password derivation schemes ...
16
votes
2answers
5k views

How big should salt be?

I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2). Having that in mind, how big salt should I use? Should it be ...
1
vote
1answer
57 views

Are multiple applications of a salted Linux MD5 hash easier to break than one? [duplicate]

I have hashed the same password a lot of times (approximatively 1000 times) using the salted Linux MD5 format. I want to know if it's easier to recover the cleartext password or not. Is there ...
4
votes
2answers
53 views

Secure encrypted storage of values that allows DB lookups?

I'm developing a system that has to store Finnish national identification numbers as securely as possible while allowing "does this identification number exist in the system?"-type queries over a web ...
0
votes
2answers
519 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
11
votes
2answers
900 views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
2
votes
3answers
673 views

Tracking IP address to prevent abuse without logging user metadata

I am trying to balance good security practices against excessive logging of user metadata / Personally Identifiable Information. I am constructing a web app that allows for secure messaging. In part ...
2
votes
1answer
393 views

This is 2015. Has SHA1 been exploited or cracked yet?

went to Qualys SSL lab and tested one web site. One of the findings says the site is signed with weak algorithm SHA1withRSA and I did some research all are saying we should change to SHA-2. may i know ...
1
vote
0answers
96 views

how many sha1 hashes per time on current hardware [closed]

How many sha1 hashes per second can current hardware (say a 500$ gpu) compute, when the input is 256 byte long? (or any other length). The question behind is how long (or how costly) is it to mount a ...
0
votes
1answer
61 views

MySQL Database Password protection

I am developing an industry-level web server that requires that all passwords be encrypted in some way. The middle-ware for the server is Java-based. My only restriction is that I can't use API's ...
-3
votes
2answers
92 views

If I were to perform a MD5 hash every microsecond from 1-1-1970 how many hash colisions would I have [closed]

I mean with a standard length of 32 you are doomed to have some hash collision, I ask this question just out of curiosity. I havent put a supercomputer or a timemachine just yet.
3
votes
2answers
848 views

Decoding SHA-512 value

How does the SHA-512 decoder on the following page work? http://md5hashing.net/hashing/sha512#main Hash values supposed to be unable to reverse. Is this page fake?
3
votes
5answers
282 views

A secure way to encrypt a connection between 2 clients securing against both passive and active adversaries

Recently I got interested in encryption and the methods behind them. So for a fun / school project I am building a program in python to encrypt data between two clients (chat and files). I'm just ...
3
votes
0answers
86 views

How does SHA3 (Keccak & SHAKE) compare to SHA2? Should I use non-SHAKE parameters?

Keccak is the winner of the SHA3 competition. Since Keccak is highly customizable (presumably for security/memory/time/speed tradeoffs) there does seem to be some controversy around how Keccak ...
2
votes
1answer
113 views

Hashing algorithm for cryptsetup

I will encrypt my SSD using cryptsetup and I would like to know which hashing algprithm to use. First of all, cryptsetup benchmark: PBKDF2-sha256 262144 iterations per second PBKDF2-sha512 ...
2
votes
1answer
103 views

Securely storing passwords using PHP5

Starting note: After going through some articles and answers posted on SO related to storing secured passwords I'm still not sure whether my way of thinking is applicable to todays reality. I'm ...
1
vote
2answers
58 views

Salt addition in hashing? [duplicate]

I may be wrong here but reading about salt I was wondering whether if we use the same salt for every password saved in our database won't users having same password would lead to same hash even after ...
31
votes
5answers
6k views

If a web site shows me what my password was changed to, is it stored as plain text?

I just changed the password on a school-related web site. After completing the change successfully, the next page showed what the password was changed to. Can I conclude from this that the password ...
0
votes
1answer
191 views

How does PHP's password_hash() BCRYPT cost factor translate into cracking computation times

I am trying to fully understand the relationship between BCRYPT's COST factors and how much more time it would take a machine to crack a password with PHP 5.5's password_hash() The encryption times I ...
0
votes
0answers
9 views

Does a static salt in addition to a random one add any security? [duplicate]

I'm looking through some old hashing code and found something that made me raise an eyebrow. In order to store passwords, it uses BCrypt to generate a random salt and hash the password. Before that, ...
5
votes
2answers
134 views

which memory hard hashing algorithm can equalize low-computational and high-computational power devices to utilize blockchain in the IoT?

Recently IBM and Microsoft showed their interest (IBM post, Microsoft post) in utilizing bitcoin's blockchain for internet of things (IoT) development. Let's assume that in close future the blockchain ...
-1
votes
2answers
546 views

SHA256 to text or MD5

I want to decrypt a sha256 to text. Is there a way other than bruteforcing to decrypt sha256? Like if I convert that SHA256 to MD5 and then try decrypting?I know its hard and the possible way for ...
3
votes
2answers
141 views

Is there any reason for using private key 2 times when creating security hash?

One of the payment solutions for the websites provides the following way of creating security hash for payment link: hash = sha1(private_key + payment_params_json + private_key); Is there any ...
2
votes
0answers
51 views

Disallowing Similar Passwords [duplicate]

Upfront, I want to clarify that I am not a professional cryptographer, I am more curious about playing with the math and science behind it, and also want to improve my habits with my own personal and ...
0
votes
2answers
285 views

How hash ensure integrity of data? [duplicate]

I understand what a hash is, basically we calculate a hash and append it to the message and send it to the receiver. If someone alters the message, the receiver will know because there would be a ...
1
vote
0answers
51 views

Hashcat Turkish character problem [closed]

I'm using cudahashcat, it haven't special chars like "öçşĞÜ" in standart charsets. I defined charsets with windows-1254 and other encoding types(and -1 öÖçÇğĞşŞüÜıİ?a parameter), i tried but they ...
0
votes
3answers
966 views

Which PHP encryption method is most incidentally-secure?

just started researching on the latest PHP encryption methods, I've found out my favorite algorithms are compromised. MD5 is no good, SHA-1 has "found flaws", SHA-512 isn't "meant for passwords", ...
-4
votes
1answer
70 views

What is the most secure way to protect a custom CMS from infiltration? [closed]

I have a custom CMS with a randomly generated ASCII 100-character string from this site for both my username/password. I also have this following sha512 encryption system, which was created by ...
-1
votes
1answer
82 views

Disastrous aftereffects of a hashing attack

I am writing about hashing functions for my thesis. I want to know whether there were disastrous aftereffects of a successful hashing attack in history and what kind of hashing attack was used. ...
0
votes
2answers
137 views

Is my hashing function good enough

Is there an obvious flaw with this hashing function (written in PHP)? function hash($password) { sleep(1); // Make hashing slow $hash = ""; $iterations = strlen($password); for ( $i = 0; $i ...
1
vote
1answer
132 views

John the Ripper missing formats [closed]

I have an sha256 hash that I am trying to crack with John the Ripper. However, it doesn't recognize raw-sha256, raw-md5, or any hash format other than descrypt, bsdicrypt, md5crypt, bcrypt, LM, AFS, ...
1
vote
2answers
87 views

Is it known to what message size are standard hash functions injective?

This simple Python script verifies that all messages of length 1 have different SHA-1 hashes: import hashlib s = set() for i in range(256): s.add(hashlib.sha1(chr(i)).hexdigest()) print len(s) ...
1
vote
0answers
47 views

Is there any merit to the RFC 3414 (SNMPv3 User Security Model) password-to-key method?

RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at ...
1
vote
0answers
110 views

PKCS#7 signed data structure in signed PDF document

Is it mandatory to include PKCS#7 data (OID 1.2.840.113549.1.7.1) octet string into the sequence of PKCS#7 signed data? I mean if you want to sign PDF, you are basically adding PKCS#7 container ...
2
votes
1answer
83 views

What is a key-hardened hash?

I've seen the term 'key hardened hash' used to describe a recommended way to tighten up password hashing. What does this mean? Can it just mean to use a pepper?
2
votes
2answers
95 views

Does recursive hashing weaken properties of a cryptographic hash algorithm?

Specific example of mine concerns the probability of collision, where I have two plain texts A and B that I want to hash using MD5. Given the cryptographic hash function H and the following: A' = ...
6
votes
0answers
282 views

Naive implementation of Rainbow Table and/or Hellman's trade-off

This question is the same one I asked here. Since I haven't got any response or even a comment I will post it here as well. Is there any naive implementation of Hellman's cryptanalytic time memory ...
0
votes
2answers
164 views

Is this the most secure encryption/hashing system? [closed]

I've been doing some research regarding password security and after reading several topics and the Kerckhoff's principle. I came up with what I believe is a really secure system regarding online ...
4
votes
2answers
4k views

Should I use urandom() or openssl_random_pseudo_bytes()?

I am developing a site in PHP 5.4. Which function is better to use to generate a random salt for password security? $salt = sha1(openssl_random_pseudo_bytes(23)); or $seed = ''; $a = ...
1
vote
3answers
150 views

How to transform an hash into a usable password?

I was reading about PwdHash and it inspired me to create a little project where you input a master password and an easy to remember alias into a password hash, like bcrypt, and then you get an hash. ...
-2
votes
3answers
133 views

Is it really necessary to hash user passwords when I already protect my database against SQL injection? [duplicate]

I'm developing a school, I just applied all the SQL injection protections that exist and database security, administrative roles, parametrized queries, sanitize input from the client. But FOOL ME! I ...
2
votes
2answers
182 views

Reducing hash output length [duplicate]

I am using output of (keyed) hash function to make sure the input was not modified, I store it along with input. Now output of SHA-1 is 20 bytes. Say I want to reduce the output. And have it output 10 ...
18
votes
3answers
4k views

Is using the concatenation of multiple hash algorithms more secure?

Is it more secure in practice to use the output of multiple hash algorithms instead of a single one (assuming that the output size is the same)? By secure, in this context, I mean protecting against ...
2
votes
1answer
180 views

How can Alice and Bob prove that they share a file?

Carl asks Alice and Bob if they have a file f such that for a secure cryptographic hash function h, h(f) = K. Both claim to have f, but they can't show the file. Carl doesn't believe them. He can ...
13
votes
3answers
5k views

Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?

Given an option , which one should I choose , a HMAC for storing a password securely or a bcrypt or scrypt library?