A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

-2
votes
2answers
56 views

Is there a reason to salt instead of enxrypting data? [duplicate]

Is it more secure to: a) Take a password, salt it, then hash it. b) Take a password, hash it, then encrypt it(Using a symmetric algorithm with a large key)
3
votes
2answers
666 views

Getting reliable checksums

Update: A version of transmission that contains malware has been distributed very recently. Quoting this ars technica article: It appears that somehow the Transmission website may have been ...
5
votes
2answers
206 views

Why use MD4 for caching?

ccache is a popular tool for speeding recompilation with GCC and other compilers. It works by caching previous compilations and detecting when the same compilation is done again. The detection is ...
12
votes
2answers
2k views

If multiple users on the same website all use the same password, is their password hash the same? [duplicate]

My basic knowledge would assume yes, unless websites somehow include the user name into the hashing function with the password, but I am not sure if this is common practice.
45
votes
4answers
5k views

Is this a self rolled hashing/obfuscation method? Can you recognize the pattern?

A system we're introducing into the organization is not using any traditional hashing function that I can find. I've been assigned to "approve" it by black-box testing. I suspect passwords are simply ...
2
votes
3answers
66 views

Why do websites use less effective hash functions? [duplicate]

When releasing, say, ISO files, the websites usually provide the supposed hash of the ISO to compare with, to verify its integrity. Or, to prove that it at least probably wasn't tampered with. But on ...
3
votes
1answer
156 views

Best way to hash passwords in PHP 5.3.5

What is the best way to hash passwords in PHP 5.3.5? Since in this version doesn't have password_hash().
0
votes
1answer
90 views

How can I ensure that only the message I sent, and nothing else reaches the receiver?

How do I make sure that the open channel I use to send a message to a specific receiver, is not used by a third party to send unwanted files and compromise the receivers system? Is there a method by ...
1
vote
3answers
120 views

Signatures for an antivirus

When anti-virus software compares an MD5 signature for malware, does it execute the malware on my computer in order to generate the appropriate signature to compare against? [ORIGINAL QUESTION] MD5 ...
0
votes
3answers
97 views

How does encryption force a processor to “pause”?

I'm often told that encryption forces processors to "make a pause" when performing the math to decrypt a hash, which is why brute forcing can take so long. I don't understand what it means for a ...
5
votes
2answers
143 views

Why are we using SHA3-512?

As we know, hash algorithms can be used for authenticity of a message. In my understanding, since the message lengths are too large, we convert it into a hash value using hash algorithms and these ...
1
vote
0answers
115 views

Can password hashing both client side and on the back end improve security if we don't necessarily trust the server? [duplicate]

I want to know if it ever makes sense to hash a password client side and rehash it again on the back end. I've not seen this done before which makes me suspicious as to whether it really does add ...
0
votes
0answers
15 views

Is encryption with a destroyed key a good cryptographic hash function? [duplicate]

Obviously this isn't something I was going to implement, but it was a question floating at the back of my mind. So let's say that instead of hashing passwords to store in the database, you encrypt ...
-2
votes
2answers
185 views

How to securely transfer password from a registration page to the database [duplicate]

What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http) when the user registers for the first time on ...
4
votes
2answers
192 views

Location of Password Hashes on a Windows Local Machine?

"Where are the two locations that user's password hashes are stored on a local windows machine?" My place of business asked me this question. I know that the SAM stores password hashes, where would ...
-7
votes
2answers
260 views

What is is the best way to create virus signature database? [closed]

We are thinking to develop a new Antivirus program. The main concern is to create a virus signature database. I want to ask what is the best possible way to add viruses signature in our database to ...
1
vote
0answers
39 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
1
vote
1answer
130 views

How can one securely hash passwords server side while avoiding DoS?

It is generally recommended that one use a slow hash function to hash passwords. However, does this create a DoS risk?
8
votes
2answers
104 views

Is there a threshold of bits of entropy below which hashing becomes meaningless?

I just read a help page by a mail provider in which they state that all mobile phone numbers will be stored as a salted hash. This strikes me as interesting, since phone numbers don't contain a lot ...
2
votes
3answers
134 views

Verify password hashed with nonce when the password is already hashed on the server?

I found this picture in the Wikipedia nonce article: To avoid sending the password in clear text and prevent replay attacks, the password is hashed together with one random number from the server (...
1
vote
3answers
152 views

why not use hashed password as password [duplicate]

Why dont we use our mobile phone tho hash a password and then enter the hash on a website as the password ? This way the password for the website would be much more complex. Would this even increase ...
-5
votes
3answers
85 views

how to know the way in which password was encrypted [closed]

i have a encrypted password basically hashed i don't know what it is some thing like 11dfb34b27f539a5e785b68e529fd470 and i know the password i.e., the plain text but i want to know the way that how ...
1
vote
2answers
100 views

Isn't oAuth weaker than traditional passwords

I understand the need for oauth for programmatic access to apis, etc. whereas passwords are used for more human-level authentication. However when we store passwords, we (hopefully) salt + hash them. ...
0
votes
2answers
75 views

PGP vs Hash functions

What is the difference (in terms of security strength) between checking a package' integrity using pgp and hashing functions (i.e. sha256)? Isn't pgp less secure as the verifier must trust the ...
-2
votes
1answer
55 views

What reasons for implementing reversibly encrypted data are there? [closed]

Excuse me if I am wrong, as I am very new to the field, but it seems that the only reason one should encrypt something in a reversible way is if the object receiving the encrypted data is a person. (i....
0
votes
2answers
112 views

Using a hash to encrypt data

Lately, I've been reading about cryptography and thought of a method of using hashes to encrypt data. From what I know, hashes are unique to each object and are one way functions. Encryption on the ...
1
vote
1answer
103 views

Re-sign Certificate Using Different Hashing Algorithm

Consider a certificate used by a Certification Authority. This is currently hashed using SHA-1. I'd like to keep the same public/private key for this, but hash it using SHA-256. By hash it I mean hash ...
1
vote
3answers
42 views

Why are there Hashes next to downloads? [duplicate]

I've seen several sites wehre they would put the hash of the downloadable file next to the file. Why do they do this ? I understand the purpose of comparing the hash of your file with the online hash ...
6
votes
1answer
308 views

Who in UK I can report to if I know company is storing my password in plain text?

I live in UK, some time ago I wanted to login to my electric company account to check the bill and such, and I had forgotten my password - long story short I got my account locked and had to call them....
3
votes
2answers
131 views

Are there any known MD5 hash collisions of messages of different length?

All the examples of MD5 hash collisions I've come across comprise two different messages (inputs) of the same length. The first and second messages have different values for a number of bits and the ...
27
votes
10answers
5k views

Could I recover the content of file from its checksum/hash?

Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file. Now assume ...
0
votes
1answer
286 views

How to brute-force WPA-2 password of specific set of characters using oclHashcat?

I want to test oclHashcat on a WPA-2 PSK password of length 8 containing only characters in the set {a-z, A-Z, 0-9}. To do this I have already captured the handshake in a .cap file and converted it ...
1
vote
3answers
174 views

Hash algorithm that provides less than 10 bytes

I know it's insecure, but I need to for number of profile; I need a hash algorithm to provide less than 10 bytes.
0
votes
0answers
49 views

Applocker rules Publisher vs hash

I'm interested in deploying application white-listing for a large scale environment by using the Windows Server built-in AppLocker mechanism. There is no Internet connection to the environment. My ...
-4
votes
1answer
152 views

insecure hash functions

Good hash function should be collision resistant. In 2004 it was shown that MD5 is not collision resistant. As such, MD5 is not suitable for applications like SSL certificates or digital signatures ...
1
vote
2answers
133 views

What is the real advantage of using a “more secure” algorithm like bcrypt for password hashing?

I read this article about password hashing using bcrypt as the recommended method. The advice is similar to what they're saying on hacker news about not using something like SHA2+salt. There are other ...
0
votes
0answers
39 views

Hash function for credit card [duplicate]

Hey PCI and hash expert, What hash function is good for hashing credit card and providing collision resistance? Some context: We are building a tokenization service, so each credit card will have ...
0
votes
1answer
52 views

Unique human view count system without captcha on Pay Per click system, using cryptographic proof of work

I have a system that will be paying users per unique view on a page. I need to prevent 80% of fraudulent automated traffic from being counted. I need to avoid captcha.I would like to implement a ...
1
vote
0answers
64 views

SHA1 and SHA256 initial digest to start from

Let's say I have: C = A + B where A and B contain strings and the plus sign means concatenation. I already hashed A with SHA1 and SHA256 and got a digests. I forget what the original A string was, but ...
2
votes
1answer
114 views

PHP BLENC extension security concern

PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
2
votes
2answers
95 views

What does it mean to have authentication without confidentiality or authentication without encryption?

I came across these functions m+EeA(H(m)) (for authentication without confidentiality) and m+H(m+k) (for authentication without encryption) and I'm having a bit of a difficult time understanding them. ...
-1
votes
1answer
34 views

Format of hashed strings [closed]

When hashing a string, sometimes I see the format like so: {SHA512}1G2zjh2Bso/LzS06JDLXcELCJX4TQm7oXL5Et3Yg4Veyji7iQW26VnBdEHiURM5evO6duJjzY5387mkWV0oiyYA= Specifically the section indicating the ...
5
votes
2answers
127 views

When can you not use strcmp?

I've read that one shouldn't use strncmp(userSuppliedPassword,origPassword,sizeOfArray) (or String.equals in Java) since one can use a timing attack to guess the password. Rather, one should use a ...
1
vote
1answer
83 views

Protecting email addresses if their hashes are publicly avaliable

I am working on a project, where user email address hashes will be available publicly, and I need to prevent them from being quickly discovered by spammers. The main idea of the undertaking is to ...
3
votes
2answers
107 views

Use password to calculate checksum for API requests

I was wondering if it would be an effective way of securing an API by requiring all requests to be checksummed, salted with the users password (or a hashed version)? With securing I mean making it "...
2
votes
3answers
198 views

Parameters for PBKDF2 for password hashing

I use PBKDF2 with SHA-256 to store hashes of passwords. I use the following parameters: number of iterations desired = 1024 length of the salt in bytes = 16 length of the derived key ...
0
votes
1answer
28 views

First string in hash collisions bucket

My understanding of hashing is conceptual at best and I'm assuming things that I'm not sure of and it leads me to a question that I don't even know if it's founded or not. So please correct my ...
5
votes
1answer
123 views

Random string vs hash(random string)?

I'm implementing a one-time token service. Each of these one-time token represents some server side data/action associated with it (a 'email confirm' action for example), so that my web service can ...
-1
votes
1answer
67 views

Is there any kind of encryption that returns constant number of characters?

I wonder if there is any kind of publicly known encryption (not hashing) algorithm that generates constant number of characters independent of the input. I have came across an online platform that ...
3
votes
2answers
100 views

Sign a callback URL

I have a Single Sign-On system that works this way : User clicks link on clientsite.com that redirect him to mastersite.com?returnTo=http://clientsite.com If auth is valid, the user is redirected ...