A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

12
votes
1answer
754 views

General purpose slow/unique hash routine for dup checking of private data, without storing the data itself?

I am wondering if there is a percentage of uniqueness known to be lost with every repeat of various hash routines, like MD5, SHA1, and how that might compare with other algorithms. If theoretically I ...
10
votes
4answers
1k views

Does hashing a PRNG make it cryptographically secure?

Would hashing the result of a regular random number generator produce a cryptographically secure PRNG? For example, would sha1(rand()) effectively be a secure PRNG? Assuming it doesn't, how would ...
8
votes
1answer
3k views

How can I extract the hash inside an encrypted PDF file?

As long as I know, the encrypted PDF files don't store the decryption password within them, but a hash asociated to this password. When auditing security, a good attemp to break PDF files passwords ...
26
votes
8answers
3k views

Why is password hashing considered so important?

After reading this article, I can see the benefits of password hashing as a second layer of defence, in the event of an intruder gaining access to a password database. What I still don't understand is ...
21
votes
5answers
1k views

Hashed password storage with random salt

Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
12
votes
1answer
1k views

Torrent “bad seed” attack by Sony, how does it work?

Sony recently saw a large amount of data stolen. In order to prevent the stolen data from being spread using torrents, they are doing what was called a bad seed attack. What is this attack? Is this a ...
18
votes
8answers
3k views

Why should I hash passwords?

I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it? When a ...
18
votes
1answer
1k views

Doing a dictionary attack on RSA if you have the public key?

I'm trying to learn exactly how RSA works. Currently I have a very, very simplictic overview that goes like this. Having the public key allows you to encrypt things. Encrypting the same message ...
13
votes
3answers
2k views

What is a good enough salt for a SaltedHash?

Since I'm hashing all passwords with each their own salt, is there a benefit to the salt being really random, or would an incremental counter or a guid be good enough? Also, is there a benefit of ...
6
votes
2answers
258 views

Does password-hashing “busy-work” need to be cryptographically secure

All modern password hashing schemes are deliberately designed to include a huge amount of "busy-work", to limit the speed with which an attacker would be able to conduct password hashing attempts. ...
4
votes
2answers
172 views

Similarity comparisons with hashed passwords possible?

At a company I worked at, I had to change my password every 90 days and I could only reuse a password after 8 iterations. This no-reusal included passwords being too similar to the old one, e.g. when ...
4
votes
5answers
553 views

Am I required to hash passwords

Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen? If not required in the US, but required in the ...
3
votes
1answer
2k views

I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? How to store salt? Ok I have been studying a lot about password hashing lately. And I have a few questions. So I ...
3
votes
1answer
475 views

How big is the risk of hash fixed points/cycles?

It's established wisdom to hash password multiple times with a salt to increase the time it takes per brute force iteration. At the same time (unless the algorithm guarantees otherwise) there's a ...
2
votes
1answer
108 views

truncated hash for message authentication?

I am using hash for authenticating the signature of the message. since the hash will be part of a url that is used for QR code, I would like to keep the hash as short as possible in order to generate ...
2
votes
1answer
945 views

PRF, IKE and hash function

The term PRF is mentioned in the documentation of the IKE (Internet Key Exchange) protocol. What is a PRF? What is the difference between a PRF and a hash function? What PRFs are used in the IKE ...
0
votes
2answers
902 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
-1
votes
1answer
148 views

client side and server side hash password [duplicate]

Another question about client or server side password hashing, I know. After reading many other post about this topic I'm still a little confused and not completely sure what is the best, because I ...
-8
votes
5answers
1k views

create a variants of MD5

I have also asked similar q here : To create a variants of MD5, I made following changes : MD5 uses a non-linear sin(i)* pow(2,32) ----> i plane to use cos(i)*pow(2,32) Instead ...
11
votes
1answer
1k views

Any risk in using the same salt for several hashes on a user?

Right now I'm storing a salt and password_hash on the users table (pretty standard stuff). The need arose to get a secure hash of another field for a user. Is there any risk in reusing the same salt ...
7
votes
2answers
4k views

Is it safe to use PBKDF2 for hashing?

I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
7
votes
8answers
2k views

Does truncating the cryptographic hash make it impossible to crack?

I store password hashes in their full value for example, $h = sha256('foo') outputs 64 characters: 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae I store that directly in the ...
5
votes
4answers
4k views

What security purpose do hashes of files serve?

Many websites offering downloads also provide the MD5 or SHA1 hashes of the files which are available for download. An example- What is the security purpose behind providing such a facility to the ...
5
votes
3answers
391 views

What steps can you take to make offline cracking of SRP harder?

In the aftermath of the Blizzard hack, what steps can I take to make offline cracking of SRP more difficult? My question assumes that your database is already gone and that you implemented SRP more ...
4
votes
4answers
2k views

Can I brute-force a password hash even if I don't know the hash-algorithm used?

Can I brute-force a password hash even if I don't know the underlying algorithm? For example if I get hold of a database with password hashes and the used hash algorithm is unknown, like a random ...
4
votes
5answers
909 views

Use the hash of the password to encrypted password

I have a app which transmit the password in clear text. I was planning to use the hash of the password (SHA-512) as the key for encrypting the plain text password. Then send the encrypted text to the ...
4
votes
3answers
994 views

Determine hashing algorithm only with known input and output

Given the input: test A system generates the following output hash: 0x001F41B6A0534D3B851D69EFE6237F550100000010D5F4FC65E64BCFDBF2590212E4411C44942C6C734C00ACFE13B958DCAB3614 I do not know ...
3
votes
2answers
511 views

Keepass Dictionary Attack Protection Strategy

Though pretty interested, I'm everything but an expert in Information Security, please redirect me to any helpful resources if my question is stupid or correct me if my assumptions are wrong. When ...
3
votes
2answers
238 views

How does my bank knows my second and forth chars of my password [duplicate]

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
3
votes
3answers
2k views

Recompute Rainbow table with salt?

So, as I understand it, you prepend a password with salt before you hash it so that the resulting hash can't be used with a rainbow table to find the original password, as you could if the password ...
2
votes
1answer
5k views

John the ripper passwd file format with salt not working

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is: $hash = md5($salt . $pass) No other ...
2
votes
3answers
2k views

Why we use GPG signatures for file verification instead of hash values?

for example here they put a gpg signature to verify what you download is what they really made. but why they just don't put a SHA256 hash value ? because its much more faster to check it and sometimes ...
1
vote
2answers
250 views

Separate database column for salt

Is it advisable to store the salt in a separate database column or should we concatenate it together with the password? Is there any difference? I have come across implementations of both types. ...
1
vote
5answers
659 views

Does shuffling a hashed password increase its security?

I am making a web app and I'm now stuck on making the login secure. I'm thinking of adding a salt to a user-inputted password and then hash it. (md5 or sha for example) and then I will reshuffle the ...
1
vote
1answer
116 views

How to verify that a clientside-generated object is genuine?

I know that general best-practice states not to trust anything generated by the client. With that in mind, I want to write an HTML5 app that utilises the browser to generate various objects ...
1
vote
1answer
274 views

Securing communication

The problem: I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
0
votes
1answer
273 views

Please help clarify password hashing - salted, multiple iterations of MD5 vs bcrypt/sha2, etc [duplicate]

I was reading an article about the Ars Technica hack here and had a couple of questions. The commenter said: "PHPass uses salted and iterated MD5 to hash passwords" My question is that if I were ...
65
votes
3answers
21k views

How can I create a password that says “SALT ME!” when hashed?

How can I create a password, which when directly hashed (without any salt) with md5 will return a string containing the 8 characters "SALT ME!". The hope is that a naive developer browsing through his ...
35
votes
7answers
11k views

Is salting a hash really as secure as common knowledge implies?

(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.) I'm implementing a salt function for user passwords ...
49
votes
3answers
108k views

Is SHA1 better than md5 only because it generates a hash of 160 bits?

It is well known that SHA1 is recommended more than md5 for hashing since md5 is practically broken as lot of collisions have been found. With the birthday attack, it is possible to get a collision ...
22
votes
5answers
4k views

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...
14
votes
2answers
7k views

With PBKDF2, what is an optimal Hash size in bytes? What about the size of the salt?

When creating a hash with PBKDF2, it allows the developer to choose the size of the hash. Is longer always better? Also, what about the size of the random salt? Should that be the same size as the ...
22
votes
4answers
5k views

How would you store a 4 digit pin code securely in the database?

I'm familiar with password hashing, using salts, bcrypt etc. But it doesn't seem like this would work to store a 4 digit pin code since the attacker could try all 10,000 combinations quite quickly. ...
20
votes
3answers
13k views

What's the advantage of using PBKDF2 vs SHA256 to generate an AES encryption key from a passphrase?

I'm looking at two comprable pieces of software which need to encrypt data on disk using a passphrase. One uses PBKDF2 to generate the encryption key from a passphrase, while the other uses two rounds ...
17
votes
7answers
3k views

Tripwire - Is it security Theater?

Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes. Let's say I have tripwire configured to run ...
10
votes
2answers
8k views

Salted hashes vs HMAC?

Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
45
votes
5answers
7k views

Password security in databases - today still best practice? [duplicate]

Possible Duplicate: Which password hashing method should I use? There are a ton of great posts about password security in databases on stack overflow and on other sites and as I am ...
22
votes
2answers
6k views

Is “real salt” the same as “initialization vectors”?

In the question about real vs. fake salt, the answers describe how real salt 'perturbs the encryption algorithm.' I know roughly how initialization vectors work; is this the same concept, or something ...
16
votes
4answers
6k views

How quickly can these password schemes really be beaten?

If you use a quick hashing algorithm like MD5 or SHA-1 to hash passwords and you don't use any salt at all, how quickly could one expect a hacker to find my password out? If I use a truly random salt ...
13
votes
4answers
4k views

How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?

I'm new to cryptography and its implementations. I'm designing an Android app where an user enters a password to retrieve some encrypted data. After some research on possible solutions I ended up with ...