A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

1
vote
1answer
90 views

Sending Salts For Key Generation

I am working on a project that uses a combination of a web based framework (Django) and an installed app (Python) for the purpose of data entry/upload. I will have to send medical records over the web ...
3
votes
5answers
348 views

PCI-DSS and salt storage

PCI-DSS states the following: 3.5 Protect any keys used to secure cardholder data against disclosure and misuse I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...
0
votes
3answers
126 views

Hash algorithm without ASIC's

I want to design a new crypto-currency, with an algorithm which is different from SHA-256 or Scrypt. But in order to do this, I need to know the hash algorithm which is the hardest to make ...
1
vote
0answers
40 views

Login details security using salt n hash and a login role in postgresql

I am coding up the security for a website in express.js and postgresql db. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but my ...
1
vote
1answer
65 views

Am I right by changing the default algorithm on a web app?

Numerous clients have told me that my suggestion on changing the algorithm on a web app does not increase security. I've tried reasoning that if the files have not been exposed, the attacker has to ...
0
votes
2answers
287 views

What is the advantage of using a symmetric cipher like AES to generate a keystream?

I see examples of AES (with a shared secret key) being used to encrypt shared secrets (e.g. nonce + counter) to produce a keystream against which the plaintext is XOR'ed to produce the ciphertext. ...
0
votes
1answer
54 views

Using multiple hash-functions along the line [duplicate]

I was wondering what the effect on strength/security is If I would use an aggregate of multiple hash-functions. For instance, I don't want to sent passwords in plain text (although it's over an ...
2
votes
2answers
165 views

How can I store a password history to prevent reuse?

I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt. How can I implement a password history set (to prevent password reuse) in a ...
4
votes
2answers
740 views

How does processor architecture affect password hashing speed?

Does hashing speed vary significantly using different architectures (x86 vs ARM)? Scenario I am investigating the possibility of using a cluster of Raspberry Pi for cracking passwords hashed with ...
4
votes
4answers
358 views

Is it a good idea to have a “master” password?

Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
1
vote
0answers
20 views

How is password character validation in 3D secure is implemented? [duplicate]

We have a website which stores hashed passwords in the database. During logins we hash the password entered by user and compare two hashes. This is quite standard so far. Our client which is in ...
-2
votes
1answer
77 views

What is this encrypted with or where can I find examples of encryptions to compare it with? [closed]

I have a hash thingy I am trying to decode and I have done relatively little with encryption, though I would like to try to learn some more. The hash is: 1YMTpavsFq7ykllC3CCsg3e1li31re1nROxuW1wqIqpk ...
56
votes
2answers
8k views

What are rainbow tables and how are they used?

Where can I find one? Is there a pot of gold at the end? How do I protect against them? From the Area51 proposal This question was IT Security Question of the Week. Read the Sep 09, 2011 blog ...
4
votes
2answers
206 views

Is it safe to use PBKDF2 for hashing?

I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
2
votes
1answer
1k views

Which part of the eapol packets contain WPA password Hash?

I have captured wifi traffic from a WPA network using Wireshark. I filtered the results for "eapol" packets and noted in the info column there are message type 3 and type 1. I believe this is two ...
236
votes
10answers
27k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
4
votes
1answer
405 views

Is every hash format that nginx accepts for HTTP Basic Auth weak against brute force?

According to http://nginx.org/en/docs/http/ngx_http_auth_basic_module.html nginx can read password hashes of these types: crypt(), apr1, SHA1 & SSHA. This is how I understand how these hashes ...
5
votes
6answers
703 views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
12
votes
6answers
1k views

Convenient cross-platform help on checking secure hashes like SHA-256

It is often helpful to be able to obtain a good cryptographic checksum of a file, e.g. the SHA-256 hash. This can be used to verify file integrity, so long as you have a reliable source for the hash. ...
1
vote
3answers
315 views

Why not hashing and salting passwords?

When I was implementing my webapp, I decided to hash and salt users' passwords in order to protect them, even though I knew that there will never be a lot of them ... if any. Of course, I'm not saying ...
0
votes
1answer
125 views

Rainbowtable - Start with plain text [duplicate]

I know how to use rainbow tables. I've already read the other questions this topic here. Well but there is still one question left. As an attacker, I usually have a hash value of a password and ...
0
votes
1answer
107 views

Is it a good idea to hash a string and use it as a passphrase?

Is it a good idea to hash(SHA-512/whirlpool) some simple memorable string and use it for passphrase(for LUKS/TrueCrypt container), instead of using just a string like t4k#La93Fs(5w5) as a passphrase?
3
votes
2answers
156 views

Rainbow Tables: What is the Reduction Used for?

This is a follow up from this answer. The answer is very good, and it put me to thinking and doing some research. I have found another good explanation on this site. At some point, the author says: ...
19
votes
10answers
2k views

Can a file contain its md5sum inside it?

Just wondering if it is possible to create a file which has its md5sum inside it along with other contents too.
3
votes
1answer
147 views

using counter instead of salt for hashing

I'm developing own protocol for secure message exchanging. Each message contains the following fields: HMAC, time, salt, and message itself. HMAC is computed over all other fields using known secret ...
8
votes
3answers
778 views

Is this code snippet good enough for password hash and salt

After a few days reading up about salting and hashing passwords, I found an actual bit of code that tells how to do it. This is what I found: $blowfish_salt = ...
1
vote
1answer
1k views

Brute force password cracking with a GPU

How are GPU's provisioned for password cracking? Do all, if not most cracking programs have special GPU aware software or do they just function at the basic driver or API level of the device? Can it ...
0
votes
0answers
48 views

Does the ordering of encryption and hashing matter? [duplicate]

I am now learning keyed hash function, where A and B share a secret key k. I want to know if the ordering of encryption E and hashing H matters? i.e. Is there any difference between H ◦ Ek (m) and Ek ...
3
votes
4answers
452 views

Irreversible hashing without collision

We are looking to allow users to log on with a smart card. The smart card reader can read the smart card ID and send it to us. We are, however, not allowed to store the smart card ID. Not in ...
-1
votes
1answer
88 views

Password sending through network [duplicate]

In case of no TLS/SSL available, why can't I use the hash of the password (SHA512) as the key to encrypt the password (with out any salt) to send through the network ? MITM attacks I can understand, ...
4
votes
5answers
506 views

Use the hash of the password to encrypted password

I have a app which transmit the password in clear text. I was planning to use the hash of the password (SHA-512) as the key for encrypting the plain text password. Then send the encrypted text to the ...
7
votes
1answer
388 views

Does bcrypt on top of md5 reduce its security?

A GitHub project I recently checked has a flawed security as they're using an unsalted md5() to hash the passwords. I opened a bug and they acknowledged it. However, the transition from md5() to ...
2
votes
0answers
121 views

How do I convert from this weird John/Asleap format to lc (for HashCat)?

I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
0
votes
2answers
161 views

How secure are hashed passwords that are salted too?

SAP Netweaver has its passwords hashed and also salted. But I read that a tool such as John the Ripper can bruteforce them. So how does security varies when passwords are hashed, in particular in the ...
4
votes
4answers
379 views

usernames and passwords

I was thinking about usernames and passwords and I was wondering how secure it would be to instead of the server having a list of usernames and accompanying hash of the passwords, just have a list of ...
30
votes
5answers
5k views

How does hashing work?

I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it ...
1
vote
1answer
170 views

What key to use in HMAC

I need to use HMAC on a certain message to guarantee integrity, but I cannot figure out what are the requirements for the key to be given as input to the hashing algorithm. In particular I have to ...
6
votes
3answers
586 views

Are online hash calculators dangerous?

I was about to use an online MD5 checksum calculator when I realized that my result could be added to a database. This is significant because the string I was going to type in was my bank password. ...
4
votes
3answers
629 views

symetric key encryption vs hashing

This is a fascinating document: top 100 passwords from adobe breach I have a question about one part of it: However, thanks to Adobe choosing symmetric key encryption over hashing, selecting ...
2
votes
1answer
84 views

MITM vs. data leakage

We are designing a web API - accessible via https only - but two schools of thought seem to have arisen among our team: Group 1 wants to adopt an approach that is more concerned about data leakage ...
6
votes
3answers
379 views

NTLMv2 resistance to bruteforcing

I have a question regarding NTLMv2 resistance to password bruteforcing. I know that some modern graphic processors (like Radeon 6990) are able to calculate billions hashes per second and crack NTLM ...
14
votes
4answers
1k views

Looking for example of well-known app using unsalted hashes

Does anyone know of a well-known application that still uses unsalted hashes for password storage? I'm looking for an example for an upcoming lecture on Rainbow Tables, and I think it would add ...
1
vote
2answers
508 views

How can I check the integrity of the downloaded files?

I know we use hash functions to check for the integrity of the files etc... but my question is how can we check for the integrity of the files being downloaded from some server?
3
votes
4answers
343 views

How to tell if a site is securely storing passwords? [closed]

A site I frequent has a policy to make you change your password every 90 days. That's a cool policy, but I stumbled upon an old xkcd and facepalmed myself, because lots of doxing happens on this site. ...
2
votes
3answers
302 views

Is there a hash algorithm that can identify similar files or strings?

Is there a hash algorithm that will help you identify similar files or strings? For example, the hash for ABC and XBC would be similar rather than radically different as is usually the case. I know of ...
1
vote
1answer
326 views

Reversing a block hash of SHA-1 with known Plaintext?

Is it possible to reverse the hashing of a block in a Datastream fed to an SHA1 if the plaintext for that block is known? If it is not possible (which I assume) does it make attacks to retrieve the ...
1
vote
3answers
197 views

Brute Force In Order Or Random?

Which is faster, on average to find the original plain text of a hash: brute force in-order, or with random plaintexts?
0
votes
2answers
158 views

scrypt strength with “weak” salt

I'm working on a project where following constrains apply: There's no remote database or any other means of storing extra data like random salt When user logins in, only username and password are ...
6
votes
4answers
413 views

At what point does adding more iterations to PBKDF2 provide no extra security?

If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an ...
2
votes
1answer
714 views

Are there sha 512 rainbow tables available? [closed]

Are there sha 512 rainbow tables available for download or what kind of dimensions and processing power would be required to generate them?