A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
0
votes
0answers
34 views
Database hash for password field [duplicate]
I'm using a mysql database and am looking for a cryptographic hash method for a password with salt added to it. What would be the best hash method for this problem?
1
vote
4answers
219 views
sha512 as no-login-necessary token
My site has a news subscription system. When an item is updated, a notification email goes out to everyone subscribed to that item.
You can un/subscribe via a form on each item's page.
I wanted to ...
5
votes
2answers
572 views
Keeping user data private in a cloud environment like Google App Engine
I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
4
votes
3answers
151 views
How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores?
Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store?
You might for example have an open source ...
6
votes
3answers
47 views
Patient Hashes for Compression and Security
Are there any front-running approaches to using server-generated hashes to encapsulate patient condition in a concise manner while maximizing security?
For example, a system to represent current med ...
8
votes
3answers
4k views
Whats the difference between MAC vs hash
What is the difference between the two algorithms?
One difference that I know of, is that MAC is keyed and hash is not.
2
votes
1answer
322 views
Using John the Ripper to crack SHA hash w/ partial knowledge
Group, I have a SHA1 hash that I would like to brute-force. I have knowledge of several characters before and after the password (ie, if the hash is derived from "xxxpasswordyyy", I know both xxx and ...
0
votes
4answers
220 views
Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?
I am creating a page on a website that will show a user some authorized information from another website, and that website uses a combination of the user's user-number and a secret passphrase hashed ...
1
vote
2answers
116 views
Creating a rainbow table with predefined text
I need to extract a password from a hash. This hash was generated by prepending and appending two different predefined strings to the password:
Hash(PredefinedString1+Password+PredefinedString2)
...
2
votes
2answers
195 views
What is this hashing algorithm?
I need to authenticate against another programs user credentials to allow access to a second tie-in system. I am having trouble figuring out what hashing algorithm is being used by the first program ...
3
votes
2answers
93 views
Fixing the high-bit problem in PHP's crypt() implementation
I'm working on a site that has to have compatibility with older versions of PHP, which suffer from a high-bit issue in the Blowfish crypt() implementation. Essentially, non-ASCII characters are not ...
0
votes
1answer
117 views
Determine hashing algorthim only with known input and output
Given the input:
test
A system generates the following output hash:
0x001F41B6A0534D3B851D69EFE6237F550100000010D5F4FC65E64BCFDBF2590212E4411C44942C6C734C00ACFE13B958DCAB3614
I do not know ...
2
votes
2answers
336 views
Salted hashes vs HMAC?
Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
2
votes
1answer
162 views
Loki How to crack the password hash OSPF?
I have created for myself a lab of routers in GNS3 . Routing protocol between routers is OSPF.
Now,by Loki penetration testing, I found that routers are the feature authentication.
Using wireshark, I ...
10
votes
2answers
6k views
What are the differences between MD5, SHA and RSA?
MD5 tools output hexadecimal values. In the same manner, do SHA and RSA together produce a hexadecimal (or any other) output?
What are the differences between the MD5, SHA and RSA algorithms?
2
votes
3answers
193 views
Identify client based on computed hash
I'm currently developing a web application which will serve data to iPhone clients.
In order to be the owner of the data, I don't want other clients to be able to get it.
I thought I could use a ...
5
votes
3answers
227 views
Use of rainbow tables with the NY Times hack?
The NY Times recently published a story about how they were hacked during a four month period. The hacks allegedly were carried out by part of the Chinese military.
One part of the story that ...
2
votes
2answers
113 views
Easy protocol for email authentication
I'm cooking up a very simple system to send commands to a remote server via email. Everytime an email is sent to do_something@mydomain.net, the server runs a python script that does something ...
3
votes
2answers
265 views
How does processor architecture affect password hashing speed?
Does hashing speed vary significantly using different architectures (x86 vs ARM)?
Scenario
I am investigating the possibility of using a cluster of Raspberry Pi for cracking passwords hashed with ...
1
vote
1answer
193 views
I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]
Possible Duplicate:
Password Hashing add salt + pepper or is salt enough?
How to store salt?
Ok I have been studying a lot about password hashing lately. And I have a few questions. So I ...
2
votes
7answers
395 views
Is it possible to detect password length from hash? Does doubling your password add more security?
Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
7
votes
2answers
206 views
Content hashes to help protect resources being fetched from a CDN
During a conversation in The DMZ, it was suggested that an SHA256 hash could be used to check that content being delivered from a CDN hasn't changed before being executed, similar to how Kim Dotcom's ...
0
votes
2answers
270 views
How can I extract the MD5 hash of a password protected MS Office Word 2000 document?
AFAIK, the compound file format identifier is D0 CF 11 E0 A1 B1 1A E1, which is located in the offset 0 of the header, which has a length of exactly 512 bytes.
However that is not enough to get the ...
3
votes
2answers
199 views
is it easier to get the original password if you have multiple hashes of it?
Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
3
votes
0answers
275 views
Can an attacker guess my password length from a hash? [duplicate]
Possible Duplicate:
Possible to detect password length from hash? Is doubling your password adds more security?
Considering I do not provide him any personal information relating to it, are ...
2
votes
1answer
118 views
Can a salted hash be an effective MAC?
An HMAC is basically a "keyed hash". Only the correct message and the correct key will produce a particular hash digest efficiently.
Conceptually speaking, the same can be said for a salted hash; ...
1
vote
5answers
286 views
Is SHA-1 encryption?
I have read that SHA-1 is a cryptographic hash function. On an exam, SHA-1 was given as a possible one-way encryption algorithm. Does SHA-1 require a key as input? Is a key required to qualify as ...
3
votes
4answers
186 views
When hashing passwords, is it okay to store the algorithm used right there in the database?
Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
2
votes
6answers
601 views
“Double hashing” with 2 different hash functions
Is doing something like this
sha256(sha512(password+salt))
Less secure then just doing
sha256(password+salt)
I've heard it will increase collision chances.
I can think of 3 reasons to do this
...
4
votes
3answers
301 views
How should I choose a difficulty factor for my password hashing function?
Assuming that I'm doing password hashing properly and using bcrypt, scrypt or PBKDF2, how should I go about choosing an appropriate difficulty factor? i.e rounds for bcrypt, iterations for PBKDF2 and ...
1
vote
3answers
441 views
Recompute Rainbow table with salt?
So, as I understand it, you prepend a password with salt before you hash it so that the resulting hash can't be used with a rainbow table to find the original password, as you could if the password ...
1
vote
3answers
273 views
Differences between brute forcing access versus decrypting password files or databases
I was just reading about how it's better to use bcrypt to protect passwords instead of saving password hashes in databases, and that got me thinking about other aspects that hackers work on that I had ...
1
vote
3answers
163 views
Is it a good idea to have a “master” password?
Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
3
votes
3answers
271 views
Hash Function Xor
For a hash function what is the best secure method, XOR or Concatenate:
h(data1 XOR data2 XOR data3 XOR data4) ? or use h(data1||data2||data3||data4)?
-1
votes
6answers
279 views
Using passwords made of words
People say don't use passwords in the dictionary but if you use two words isn't it alright? Dictionaries have at least 10,000 entries so just two words will be 100,000,000 possibilities (and that's ...
3
votes
3answers
1k views
Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?
Given an option , which one should I choose , a HMAC for storing a password securely or a bcrypt or scrypt library?
3
votes
2answers
222 views
Is the password hash better when you concatenate the password and username?
Is the password hash (with bcrypt) better when You concatenate the username with password?
For example:
$this->hash($username . $password);
and
$this->hash($password);
Last time I used ...
4
votes
2answers
779 views
openssl: recover key and IV by passphrase
A large amount of files were encrypted by
openssl enc -aes-256-cbc -pass pass:MYPASSWORD
Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
4
votes
3answers
2k views
How to crack password hashed using SSHA?
Is it possible to crack a password hashed using SSHA if I know the salt? How can I do it?
1
vote
3answers
317 views
Will SHA1 of Email Addresses Always be Unique?
We want to store data about a person without storing their email address, but we want to latter connect that person with their data upon them supplying their email address.
Storing a SHA1 of their ...
2
votes
3answers
100 views
Clarification on an email about a security breach
I got the following email from a forum I was subscribed to:
It is our duty to inform you that there has been a security breach on
the server that Doom10 was being hosted on. It doesn't seem like ...
5
votes
2answers
139 views
Can a HSM be used to make password hashing stronger?
Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
6
votes
2answers
722 views
With PBKDF2, what is an optimal Hash size in bytes? What about the size of the salt?
When creating a hash with PBKDF2, it allows the developer to choose the size of the hash. Is longer always better? Also, what about the size of the random salt? Should that be the same size as the ...
1
vote
3answers
171 views
For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?
I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
1
vote
3answers
246 views
Using only password to authenticate user (no “username” field)
I am creating a client access system, to allow manage invoices, make payments, access information about their products and information/functionality alike.
Supposedly there are less than 1000 ...
2
votes
2answers
167 views
In this example why do they hash a randomly generated piece of salt before hashing it with the password?
From here, in the code return substr(sha1(mt_rand()),0,22); what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append ...
16
votes
3answers
971 views
Is there any advantage to splitting a password?
I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm.
The LM hash is computed as follows:
The user’s ASCII password is converted to uppercase.
...
16
votes
9answers
581 views
Does hashing a file from an unsigned website give a false sense of security?
Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
0
votes
3answers
154 views
Why is it necessary to match the checksum of a download with another file provided by the same server? [duplicate]
Possible Duplicate:
Does hashing a file from an unsigned website give a false sense of security?
On many servers providing files for download, there is a file on which checksums are ...
0
votes
2answers
284 views
Tool for generating MD4 collisions
There are a lot of research papers available online that discuss vulnerabilities of MD4 algorithm, but I couldn't find any implementation of these.
Uptill now I have used tools like John the Ripper ...
