A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

2
votes
3answers
8k views

Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself? [duplicate]

I have moved this question from stackoverflow to this place. I know it may be a question about 'opinion' but I am not looking for a private opinion but a source of the final decision to keep it this ...
8
votes
3answers
2k views

Is it easier to get the original password if you have multiple hashes of it, all created with the same hash function?

If you have multiple hashes of a password, all hashed with the same hash function, is it possible to use this to speed up retrieval of the original password in any way? (I found the question "is it ...
5
votes
1answer
968 views

Should I be worried about brute-forcing passwords that encrypts AES?

I am building an application that needs to locally store sensitive data, that is encrypted using the sha256 of a password provided by the user. It uses AES for encryption. I am worried that some ...
2
votes
1answer
79 views

Why hashing algorithms in layer 2 are weak? [closed]

It's known that hashing algorithms such as md5 and SHA1 are weak and can easily be cracked. I wonder why many layer 2 and 3 devices such as cisco switches still use weak hashing algorithms but don't ...
41
votes
5answers
23k views

How does hashing work?

I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it ...
0
votes
2answers
14k views

If hashing is one way, why can we decrypt MD5 hashes?

I have read some times that hashing is a one way function, that is you can make the hash of a message, but you can't recover the original message from the hash, just check its integrity. However, if ...
108
votes
6answers
42k views

Password Hashing add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
5
votes
1answer
92 views

If I obtained a username and the salted password pairs from a server, can I login?

I am studying Salted Challenge Response Authentication Mechanism (SCRAM). According to the description at https://tools.ietf.org/html/rfc5802#page-8 it seems that the Client does not have to know ...
18
votes
8answers
3k views

Why should I hash passwords?

I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it? When a ...
28
votes
7answers
24k views

Is MD5 considered insecure?

After all these articles circulating online about md5 exploits, I am considering switching to another hash algorithm. As far as I know it's always been the algorithm of choice among numerous DBAs. Is ...
3
votes
1answer
279 views

How could a publicly available stream cipher (RC4) be kept secret so long?

I'm reading about the cryptographic function called RC4. Apparently, its method was kept secret from 1987 until 1994 despite being available to the public for licensing and use. How did it stay ...
5
votes
2answers
3k views

This is 2015. Has SHA1 been exploited or cracked yet?

went to Qualys SSL lab and tested one web site. One of the findings says the site is signed with weak algorithm SHA1withRSA and I did some research all are saying we should change to SHA-2. may i know ...
1
vote
2answers
99 views

Why is finding a strong collision only half the work of a weak collision?

Regarding hash collisions, an attacker only has to do half of the work to find a collision when they can control both messages compared to when they are trying to find a weak collision. This can be ...
1
vote
2answers
641 views

Why can't an n-bit hash be cracked by hashing every single n-bit plaintext?

I'm wondering why it's so hard to find collisions for cryptographic hashes. Take for example a hash function that outputs a 64 bit hash. In order to find collisions, if you feed the function every ...
1
vote
2answers
67 views

What type of hash is this? Just to verify my assumption [closed]

vwTjXNzdPQQMxhyYGB6jvxJW12hjCUG4rLDxtVevwdg=:StM_M8a4HxYpL5I-HteQqmINjjuPtOw9wPcoCacK_qk= It looks like a base64 but when I try to decrypt it, it doesn't work. I read about some hash having this ...
3
votes
2answers
177 views

Why does LastPass store password hashes on the server at all?

While reading about LastPass' breach, I was wondering why would LastPass store strengthened password hashes at all on the server side? Could they only store the AES encrypted data and when the user ...
0
votes
0answers
58 views

Hashing Identifiers to Create Pseudonyms

I'm wanting to share datasets between two organisations in a pseudonymised way such that they link together via mutual entities (e.g. people) but so that the entities cannot be identified. E.g.: ...
2
votes
3answers
3k views

Proper hash_hmac key creation

I'm looking for, but unable to find, some definitive information on how long to make the secret and what characters are useable in creating a HMAC signature in PHP using SHA256. I found some ...
6
votes
1answer
2k views

How can I extract the hash inside an encrypted PDF file?

As long as I know, the encrypted PDF files don't store the decryption password within them, but a hash asociated to this password. When auditing security, a good attemp to break PDF files passwords ...
4
votes
3answers
239 views

Question regarding MAC and encryption

I was reading the chosen answer to the following question - "MAC vs Encryption" They say that just using encryption, "an attacker could alter the ciphertext to make it say something else when ...
0
votes
1answer
176 views

Is this a good hash function?

unsigned int hash(bytearray[] msg) { unsigned int hash = 0xDECAFEBAD; for(i = 0; i < msg.length(); i++) { hash = ((hash << 4) XOR (hash >> 28)) XOR msg[i]; } return ...
5
votes
1answer
88 views

Salting/Hashing a password

I don't have a security background, so I'm not sure on the best approach for this, I'm developing an android app which users will need to login to (all local). I'm going to store the password in a ...
1
vote
5answers
849 views

Should BCRYPT be used for client-side password hashing

I am concerned about the use of bcrypt for client-side password generation. I am developing a password generation function to be used client-side, similar to PwdHash and PasswordMaker. Much has been ...
2
votes
2answers
81 views

which encryption is used in this JS Variables

Which encryption method is used for these variable names: var g_license_info var g_server_time_obj Respectfully encrypted to: var ago05b4e111efe149737a67a177f00ffad2 var ...
4
votes
1answer
96 views

A predictable password generator for offline clients

I know this sounds like pretty dumb question. Why would you use a password generator at all if it's predictable. But suppose you have a server and client - the server always requires a password and ...
3
votes
0answers
87 views

How far should I go in protecting a user's SMBIOS UUID?

My server will be receiving data from several hundreds of computers. As part of keeping track of which computer sent what, I will be fingerprinting the hardware and keeping the results in my database. ...
4
votes
1answer
154 views

Why is Windows password security designed this way? [duplicate]

Let's start with the LM hash. The LanMan hash had MONUMENTAL security flaws, like the password being case insensitive (converted to upper), which reduced the keyspace for a brute force attack. On top ...
3
votes
2answers
156 views

How to give “Forgot password” option for a password encrypted file?

I have created a utility that encrypts a file (.txt, .dox, so on...). The utility asks for a password from user at the time of file encryption. Problem Suppose a user has created 1000 encrypted ...
5
votes
2answers
566 views

Why not slightly modify an existing hashfunction to create your own? [duplicate]

I read this interesting question on why improvising your own Hash function out of existing hash functions is bad. However this is specifically focusing on 'mixing' existing hashfunctions. What if for ...
5
votes
3answers
162 views

How to prevent a prophecy from becoming self-fulfilling or self-defeating

Let's assume that I have deduced with a high probability what a certain famous person or organization will choose to do at a near-future date. How can I publish any proof of me having deduced this? ...
1
vote
3answers
114 views

how to authenticate user in client-server implementation

So I am trying to implement a client-server application for sending files over SSL sockets. And I am trying to decide on a very secure design for authenticating the client. The server is going to ...
-3
votes
1answer
73 views

Hash regex for malware recognition [closed]

I'm looking to store two types of hashes for recognizing blacklisted code. These are the FireEye "import hash" (or imphash) and the ssdeep "fuzzy hash". Is there a regex (or formal documentation) I ...
1
vote
1answer
101 views

best practices for storing retrievable passwords

I am trying to build a NMS (network management system) and I am required to store passwords for 3rd party databases, devices and servers that are being managed (not user passwords). These passwords ...
5
votes
1answer
154 views

Distributed tokenization for credit card numbers

I have two locations within the same firm that hold credit card numbers. I want to be able to "join" on credit card number to do business analytics after transmitting card number-linked data from one ...
2
votes
1answer
140 views

What is a key-hardened hash?

I've seen the term 'key hardened hash' used to describe a recommended way to tighten up password hashing. What does this mean? Can it just mean to use a pepper?
2
votes
2answers
103 views

Best hash for indexing and searching encrypted data

I would like to be able to do database look-ups on a set of data based on one of the encrypted fields. My understanding of the best practice for accomplishing this is to store a hash of the data I ...
6
votes
2answers
496 views

How facebook knows my new password is too similar to my old password? [duplicate]

I am still very new to Information Security field and as far as I know, websites use hashing algorithm on user's passwords before storing it and they don't know the plain-text password of a user. ...
2
votes
2answers
2k views

TrueCrypt VS LUKS Bruteforce Resilience

I have been researching LUKS vs TrueCrypt topics -- my only concern is security, but most of the discussions I see focus around usability / interoperability . I know TrueCrypt has a bunch of nice ...
3
votes
1answer
478 views

Can I know somehow if my password hash is known?

Is there a secure way to know if my password's hash is publicly known on the internet? First I tried to search for it in Hashes.org (http://hashes.org/search.php), but then I suspected, that if it ...
2
votes
0answers
45 views

Is the 64-bits length of the original string padded as well in the MD5 hashfunction?

So, for example I have a string which binary value is exactly 512 - 64 bits long, so the binary conversion of the string does not have to be padded. So that means I have a string of 56 chars. The ...
1
vote
1answer
38 views

Hashing Based Encryption

Let's say you take a 256 bit key and never use it to encrypt anything. You receive a message with a 16 character unique randomly generated salt pre-pended. You salt your key with the 16 character ...
-2
votes
1answer
65 views

Finding the cryptographic hashing algorithm, given the plain text and the corresponding salted hash [duplicate]

I have a salted hash (say about, 110 characters long) and the corresponding plain text that I used for hashing. As the title says, is it possible to do find the algorithm via crypt-analysis? What is ...
2
votes
1answer
121 views

How to “Pass the hash” when LM hash is disabled?

I ran the NTLM_stealer metasploit module and ended up with the following results: LMHASH:Disabled NTHASH:008940f335e9b2ddc182bb5b960a0c5bad0b125cbee3cf84 I was wondering if there is way to ...
7
votes
2answers
986 views

Does Outlook store plain-text passwords?

A long time ago when Microsoft changed my e-Mail from Hotmail to Outlook the password-interface said that I should only put in the first 16 chars of my password. But my password was longer before. So ...
0
votes
1answer
55 views

Store Hash and/or Encryption salts in database [duplicate]

I am doing a custom login for practice purposes, and i am wondering what would be the logical way to save the hashed password and the salts. Salt/Hash operations are using Rfc2898DeriveBytes class. ...
24
votes
1answer
2k views

How can the content of a file refer to its own MD5?

So I just saw this picture on Imgur: http://imgur.com/gxRCrCM The intriguing thing about it is that the picture refers to an old Daft Punk song named "Face 2 Face". The image's MD5 is ...
2
votes
3answers
227 views

Hashing passwords in OpenLDAP

I've seen a few posts on the internet saying most people store user passwords in OpenLDAP using one of OpenLDAP's many, built-in hashing functions. But OpenLDAP itself recommends handing off password ...
63
votes
11answers
9k views

Is there any way my password is hashed, if I'm only ever asked to provide 5 out of many characters? [duplicate]

There is a system that, on a login form, presents about 40 boxes for password letters (to hide password's actual length), and only random ones (the same amount each time) are editable. Explanation is ...
0
votes
2answers
109 views

Reverse engineering of hash functions

I have an unknown process that gets some vars and returns an 8byte hash. I'm sure which vars it gets and I'm sure these are all the variable parts of the input. I can query this process when and how ...
1
vote
0answers
40 views

Key stretching approaches

I've seen that a number of key stretching algorithms and they involved increasing the number of operations needed to compute the key(i.e. the number of rounds within a hash function). But, I wonder if ...