A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

3
votes
1answer
63 views

Is appending plaintext to salt equally safe as appending salt to plaintext

Is using hash(salt, plaintext) equally secure as using hash(plaintext, salt), i.e. can the plain text be appended to salt in place of appending salt to the plain text. Why or Why not? What kind of ...
-1
votes
2answers
163 views

Simplest way of hashing a password with multiple different hash algorithms [closed]

I have a list of plaintext passwords that I would like to hash with various different hash algorithms (for educational purposes). As a minimum I would like to obtain hashes under MD5, SHA1, SHA256, (...
3
votes
1answer
108 views

Md5 vs Md4 recognition

Is there a way to actually find out whether a hash is MD5 or MD4? For instance: 10c7ccc7a4f0aff03c915c485565b9da is an MD5 hash be08c2de91787c51e7aee5dd16ca4f76 is an MD4 hash I know that there ...
3
votes
5answers
619 views

Why can passwords be used to encrypt data, but are less strong for authentication?

Encryption software is often password based. Even if the adversary gets your computer they can't get the data without knowing the password, and bruteforcing is infeasible. Websites use passwords to ...
10
votes
2answers
14k views

How weak is MD5 as a password hashing function ?

A professor told us today, that MD5 is weak. I understand his chain of thought but pointed out, that IMHO MD5 is a good way to go if you would use a long (even really long) dynamic salts and static ...
41
votes
3answers
4k views

Security Review - password_hash implementation for PHP

I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
14
votes
2answers
359 views

How does SHA3 (Keccak & SHAKE) compare to SHA2? Should I use non-SHAKE parameters?

Keccak is the winner of the SHA3 competition. Since Keccak is highly customizable (presumably for security/memory/time/speed tradeoffs) there does seem to be some controversy around how Keccak ...
3
votes
2answers
175 views

Is signing android apk file with SHA1 digest secure enough?

Google command line example for signing apk files: $ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name source: http://developer....
81
votes
10answers
10k views

Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?

I always hear "A long password is good, a longer password is better". But is there such a thing as a "Password is so long it is becoming unsafe" or "Password is long enough, making it longer won't ...
6
votes
2answers
125 views

Is it good to store passwords in a separate table/database and manage them in a separate process?

I'm quite a newbie at systems architecture and security so I just want to check that this plan makes sense. I'm building a web app and I need to store a password for each user. I've already read ...
-4
votes
1answer
69 views

Sum two SHA256 to get a SHA512 [closed]

I see this code in a web game SHA512(SeedServer + "|" + SeedUser) and I'm trying to reproduce this hash. I tried in PHP: <?php echo hash('SHA512', '...
7
votes
3answers
79 views

Does verifying an additional fraction of a file decrease the chances of collision?

If I have a file of indeterminate length and I generate the SHA256 of that file, then generate the SHA256 of the first half and the last half, then verify all three, does that decrease the odds of a ...
8
votes
1answer
3k views

How can I extract the hash inside an encrypted PDF file?

As long as I know, the encrypted PDF files don't store the decryption password within them, but a hash asociated to this password. When auditing security, a good attemp to break PDF files passwords ...
2
votes
2answers
115 views

Where to store a pepper?

Assuming you're using a pepper in your password hashing, where should it be stored? I know you shouldn't store it in the database since it can easily be found there during a dump and the idea is to ...
30
votes
2answers
3k views

Is it possible to get hacked if my bcrypt hash is publically known?

I just checked https://haveibeenpwned.com/ and I have noticed that I was pwned, therefore I checked the file that hosts the details of my "credentials", however, I see my email in plain text but the ...
3
votes
1answer
154 views

MD5 Algorithm: A basic explanation of the process

Could anyone please explain the basic idea and steps involved in the MD5 algorithm? I tried reading it on the web (Wikipedia etc.), but it was just too high level for me. So, can someone explain the ...
5
votes
1answer
376 views

self-signatures using SHA1

This page says: self-signatures must not use SHA1 You can check this by doing: gpg --export-options export-minimal --export <keyid> | gpg --list-packets |grep -A 2 signature|grep '...
6
votes
2answers
1k views

Can I use SHA-512 hash as AES key?

I want to combine hashing and encryption for better security. So can I use a hash key generated from SHA-512 as a key in AES. For example, I have a password "secret", I calculate SHA-512 hash for it ...
0
votes
0answers
141 views

HMAC Token - Check Logic

I have a situation where I need a token that provides authentication. The common HMAC procedure I found is: Get Some key using login credentials Create Message, append key and other message data (...
3
votes
1answer
91 views

What fuzzy hashing algorithms exist?

I have been trying to find information on fuzzy hashes, and I have found surprisingly little. I know that fuzzy hashes can be used to detect if a piece of malware has changed slightly. I would rather ...
6
votes
2answers
173 views

How is SHA-1 insecure if it is not vulnerable to what MD5 is?

I have been hearing a lot lately about how SHA-1 is no longer going to be used because of how weak and insecure it is, but if it is not vulnerable to collisions like MD5 is, then how is it weak and ...
17
votes
3answers
18k views

openssl: recover key and IV by passphrase

A large amount of files were encrypted by openssl enc -aes-256-cbc -pass pass:MYPASSWORD Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
2
votes
1answer
102 views

Is storing encrypted and hashed versions of the same data less secure?

I have some database columns which are encrypted. Obviously there is no way to filter these by plaintext value. As the data stored in the db is ~~salted~~ combined with the IV, there is no way to ...
13
votes
5answers
28k views

SHA, RSA and the relation between them

SHA is the hashing mechanism. However, RSA is the encryption algorithm. So does RSA algorithm use SHA hashing mechanism to generate hashing keys which in turn is used to encrypt the message?? ...
2
votes
3answers
54 views

Pre-generating 'secure tokens'

In our web app we make good use of single use tokens. For example, when somebody creates any of the three "accounts", resets their password, or any other number of things that require random single-...
1
vote
2answers
71 views

How can i Identify and use hash function given enough text and their hash?

So, I have this old program currently in use, as i have access to the database i have adopted all data i need except the user passwords.. Now users will provide me with the plain text password and ...
7
votes
1answer
160 views

Increasing the Calculation Cost of Hashing [duplicate]

Is this a secure way to increase the calculation cost of md5 or sha1? public static byte[] increaseHashComplexityMd5(byte[] hash, int loops) { for(int loop = 1; loop <= loops; loop++) { ...
2
votes
1answer
65 views

php's password_hash with system wide salt [duplicate]

I'm thinking about using password_hash function for generating password hashes. I have read that own salts shouldn't be generated and instead use the default one that the function generates. Own salts ...
32
votes
7answers
5k views

How to prevent username and password matches when changing a username?

Let's say that I have a system where one of the security requirements is preventing users from choosing a password that matches their username. Usernames are not case sensitive but the passwords are. ...
1
vote
3answers
97 views

Are hashing functions designed to be injective where the domain is limited to the codomain?

Using the example of md5, I would like to know if md5(h₀) == md5(h₁) for some distinct md5 hashes h₀, h₁. Are hashing algorithms generally designed to avoid this sort of collision? Do MD5, SHA1, ...
0
votes
1answer
84 views

Checking a salted hash against known password?

I've created a mysql dump of my users and passwords and awked them into a presentable form: Passwords: '...
3
votes
1answer
91 views

Can I generate a random 32 bit key by using the Java hashCode and random English words?

I want to generate and communicate a 32 bit key to Bob over a phone conversation. I know he happens to have the same Java and OS installed as I have. Suppose I have a dictionary of 100,000 (English) ...
3
votes
2answers
666 views

Getting reliable checksums

Update: A version of transmission that contains malware has been distributed very recently. Quoting this ars technica article: It appears that somehow the Transmission website may have been ...
3
votes
1answer
196 views

Is this encrypted information? Why is it in a URL?

There's a vendor who sends us reports full of links to articles. Some of these links, especially ones that perform what I'm guessing is an HTTP verb of some kind, look like this: https://...
1
vote
6answers
4k views

Is this authentication scheme secure?

I want to authenticate a client of a webpage and make sure it is a particular user. Let say that we already agreed on a particular hash (SHA256, actually, which I think is secure enough for this) and ...
5
votes
2answers
154 views

Why is weakness of SHA-1 considered a threat to TLS security

If I understand correctly the role that a hashing algorithm (e.g. SHA-1) plays in TLS certificates is as follows: The hashing function is applied to a subject's public key. The CA then uses their ...
0
votes
1answer
79 views

Is there a way to securely check if a password is one of the most used ones?

So lets's say that a user wants to register to some website. For whatever reason, I want to not allow that password if it is one of the top 100 passwords used on my site (So I'm not checking against ...
295
votes
8answers
56k views

How to store salt?

Nowadays, if we expect to store user password securely, we need at least do the following thing $pwd=hash(hash($password) + salt) then store $pwd in your system instead of the real password. I have ...
-4
votes
2answers
121 views

How to identify this hash?

I have one hash, I know its value, but not its type. Here is it: 6dfb036bf703d75f9bc8219ba1224d876783fa61 I tried something like php -r "echo sha1('abc');", but it gave me another value, so this ...
0
votes
2answers
109 views

Password based Asymmetric Key generation

I am looking for a password based key derivation scheme that results in an asymmetric key pair. I have worked with PBKDF and its variants but could not come up with any way of generating a key pair. I ...
45
votes
4answers
5k views

Is this a self rolled hashing/obfuscation method? Can you recognize the pattern?

A system we're introducing into the organization is not using any traditional hashing function that I can find. I've been assigned to "approve" it by black-box testing. I suspect passwords are simply ...
2
votes
1answer
130 views

How might a PIN based Web authentication scheme work?

I'm interested in implementing PIN based authentication for a web application, similar to what Facebook provides in their mobile web site. Here is the user flow: User visits the site for the first ...
8
votes
3answers
1k views

How can I store a password history to prevent reuse?

I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt. How can I implement a password history set (to prevent password reuse) in a ...
5
votes
2answers
206 views

Why use MD4 for caching?

ccache is a popular tool for speeding recompilation with GCC and other compilers. It works by caching previous compilations and detecting when the same compilation is done again. The detection is ...
4
votes
1answer
4k views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? ...
-2
votes
2answers
56 views

Is there a reason to salt instead of enxrypting data? [duplicate]

Is it more secure to: a) Take a password, salt it, then hash it. b) Take a password, hash it, then encrypt it(Using a symmetric algorithm with a large key)
18
votes
4answers
4k views

Have weaknesses in SHA-1 and MD5 ever actually been successfully used in an attack?

Pretty much every guide, how-to, and reference for dealing with passwords and hashing has a warning in big or bold letters stating something along the lines of: SHA-1 and MD5 are NOT secure and ...
12
votes
2answers
2k views

If multiple users on the same website all use the same password, is their password hash the same? [duplicate]

My basic knowledge would assume yes, unless websites somehow include the user name into the hashing function with the password, but I am not sure if this is common practice.
2
votes
3answers
66 views

Why do websites use less effective hash functions? [duplicate]

When releasing, say, ISO files, the websites usually provide the supposed hash of the ISO to compare with, to verify its integrity. Or, to prove that it at least probably wasn't tampered with. But on ...
169
votes
8answers
38k views

Why are salted hashes more secure for password storage?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...