A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

2
votes
0answers
45 views

Is the 64-bits length of the original string padded as well in the MD5 hashfunction?

So, for example I have a string which binary value is exactly 512 - 64 bits long, so the binary conversion of the string does not have to be padded. So that means I have a string of 56 chars. The ...
1
vote
1answer
38 views

Hashing Based Encryption

Let's say you take a 256 bit key and never use it to encrypt anything. You receive a message with a 16 character unique randomly generated salt pre-pended. You salt your key with the 16 character ...
-2
votes
1answer
65 views

Finding the cryptographic hashing algorithm, given the plain text and the corresponding salted hash [duplicate]

I have a salted hash (say about, 110 characters long) and the corresponding plain text that I used for hashing. As the title says, is it possible to do find the algorithm via crypt-analysis? What is ...
0
votes
1answer
55 views

Store Hash and/or Encryption salts in database [duplicate]

I am doing a custom login for practice purposes, and i am wondering what would be the logical way to save the hashed password and the salts. Salt/Hash operations are using Rfc2898DeriveBytes class. ...
2
votes
1answer
121 views

How to “Pass the hash” when LM hash is disabled?

I ran the NTLM_stealer metasploit module and ended up with the following results: LMHASH:Disabled NTHASH:008940f335e9b2ddc182bb5b960a0c5bad0b125cbee3cf84 I was wondering if there is way to ...
24
votes
1answer
2k views

How can the content of a file refer to its own MD5?

So I just saw this picture on Imgur: http://imgur.com/gxRCrCM The intriguing thing about it is that the picture refers to an old Daft Punk song named "Face 2 Face". The image's MD5 is ...
0
votes
2answers
109 views

Reverse engineering of hash functions

I have an unknown process that gets some vars and returns an 8byte hash. I'm sure which vars it gets and I'm sure these are all the variable parts of the input. I can query this process when and how ...
1
vote
0answers
40 views

Key stretching approaches

I've seen that a number of key stretching algorithms and they involved increasing the number of operations needed to compute the key(i.e. the number of rounds within a hash function). But, I wonder if ...
63
votes
11answers
9k views

Is there any way my password is hashed, if I'm only ever asked to provide 5 out of many characters? [duplicate]

There is a system that, on a login form, presents about 40 boxes for password letters (to hide password's actual length), and only random ones (the same amount each time) are editable. Explanation is ...
8
votes
1answer
648 views

Why store a salt along side the hashed password? [duplicate]

Understand the need to protection credentials with hashes that are expensive and to use cryptographically random salts. What I would like to understand is why you would store the salt along side the ...
0
votes
1answer
44 views

Would it matter if my miner was hashing random vs incremental values?

I'm working on my miner for my "game" site that's basically a pre-image attack from a hash posted online. You submit a hash input, it's hashed, and your score is the hamming distance (the number of ...
2
votes
2answers
831 views

Is it possible to salt the SHA1 or SHA256 hash function of OpenSSL?

I would like to salt the hash function of OpenSSL external, so that I can assign a salt on my own. Is that possible or is the hash function of OpenSSL alsways internal "salted"?
3
votes
1answer
152 views

Challenge: How to find the secret key in homebrew MAC/keyed hash: sha1(key + cookie)?

I am trying to solve a security challenge on a website. Basically, the website computes sha1(key + cookie) to sign a cookie so that the user can't change it himself, and to accomplish the goal you ...
4
votes
1answer
1k views

What difference between AES_128_GCM and AES_128 and AES_128_CBC ciphers?

I encountered AES_128_GCM cipher, tried to find it in specifications of TLS1.2 and nothing, any mention. Could some one explain the difference between AES_128, documented AES_128_CBC and this new kid ...
2
votes
3answers
464 views

Strategy for updating stored passwords to more secure hash? [duplicate]

I know that we cannot update our hashed passwords without having the plain text password to re-hash. When a member logs in with login/password, we have the plain text, so that gives us an opportunity ...
5
votes
1answer
516 views

How can a system verify an online password using a phone keypad?

I phoned into a financial company's website, and it prompted me to key in my password on the phone keypad, converting the alphabetic characters to the corresponding digit, and special symbols to '*'. ...
0
votes
1answer
422 views

Extract Password Hashes from Active Directory LDAP

Currently we are working on a monthly internal security test which among other should contain a verification of the real password strength the users choose. For this reason I want to extract the ...
0
votes
0answers
32 views

Password storing using hashing only, encryption plus hash [duplicate]

I want to hash password before storing to database. I am not able to understand which approach will be suitable.For examples Hash plain password directly with SHA-1, SHA-256 etc and then store in DB. ...
0
votes
1answer
97 views

Ignoring collision and (second) pre-image resistance, what makes a cryptographic hash function strong?

With regards to resistance against dictionary and brute-force attacks to "crack" hashes containing passwords, what determines the resistance of a cryptographic hash function? Since collision ...
4
votes
2answers
872 views

What's the purpose of $LoginKey from the Ashley Madison leak?

According to this site Ashley Madison was keeping an insecure hash stored in their database using MD5, in addition to the far more secure bcrypt hash. This group used the MD5 hashes to quickly crack ...
17
votes
1answer
2k views

Password hashing : Using 2 salts [duplicate]

I'm developing an authentication service. I know the practice of generating a unique salt per user, stored in the DB with the hashed password, to prevent rainbow tables attacks. I just had the idea ...
-1
votes
1answer
287 views

SQLMAP --OS-SHELL error [closed]

root@kali:~# sqlmap -u http://www.a***********.com/info.php?id=2 --os-shell _ _ _| |_____ _ {1.0-dev-nongit-20150907} | -| . | | | .'| . | || |||||,| | || |_| ...
2
votes
1answer
51 views

Risk associate with nonce and hash found in url

I have came across a url with nonce and hash in placed which is an account activation link sent via email. The example is as followed: ...
0
votes
1answer
150 views

Is it possible to find out the salt of a MD5 hash?

I want to know whether it is possible to find out the salt of a MD5 hash? For instance we've got two MD5 hashes helloworld -> fc5e038d38a57032085441e7fe7010b0 goodbyeworld -> ...
3
votes
2answers
127 views

activate user account through email

I see a lot of people say to hash for the token on email verification when dealing with member registration. I am wondering, if the email token is only to activate the account and nothing else, ...
10
votes
5answers
2k views

Are case-insensitive passwords a bad idea?

I recently discovered a service where the password was not case sensitive. I understand basic principles of encryption and hashing so I am a bit worried, is this service storing my password in plain ...
2
votes
2answers
227 views

MD5 brute force on a faulty hash?

MD5 for passwords is considered insecure due to the ability to brute force and pick up the result. But what if I change some characters of an MD5 hash and I keep a record of that change so that ...
3
votes
2answers
103 views

Is a random work factor an increase or decrease of security?

Assume you use a proven hashing algorithm, like bcrypt with a work factor of 10 or PBKDF2 with 10K iterations. Normally that's really secure already and would give enough security already for most ...
2
votes
3answers
408 views

Implications of hashing to UTF-8 in a cryptographic function

I know that most hash functions today use Base64 encoding for their functions, resulting in hashes that use a-Z and 0-9, and, sometimes, other special characters. This results in 62-76ish possible ...
-3
votes
1answer
65 views

How do I get the password knowing part of it and the length [closed]

I'm new to all this, I'm trying to use Hash Suite to find a password with a word + 2 numbers. I know what the word is but not the numbers but I also know the length of the passwords ... What do I have ...
0
votes
2answers
434 views

What current algorithms are considered (un)secure? [closed]

With the new release of Windows 10, Microsoft has given .NET, Javascript and C++ developers a whole new bunch of options for cryptographic algorithms. Where as the old .NET code only allowed AES and ...
0
votes
1answer
92 views

what is the most secure hash for virus definition databases in 2015?

I have been told, if I wanted to create virus signatures from infected files to use for detection in the future, I should be careful as some of them are prone to collision attacks?
-2
votes
2answers
178 views

Use of Nmap ssl/http md5 and SHA1 hashes

I have below stated result on of the system by map: 443/tcp open ssl/http Apache httpd 2.0.52 ((CentOS)) | http-methods: GET HEAD POST OPTIONS TRACE | Potentially risky methods: TRACE |_See ...
31
votes
4answers
6k views

How does a hacker know how many times a password was hashed?

I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a ...
1
vote
2answers
140 views

What the most trustworthy way to demonstrate digital File Integrity?

I'm looking for ensure the integrity of uploaded files and demonstrate this integrity to a user. In my current scenario, a user sends multiple files in several different formats, these files are ...
3
votes
1answer
95 views

Can I safely and securely store hash(sessionId) in application logs?

I'm considering storing a hash of a user's session ID in our applications logs on each request. This would allow users sessions to be easily tracked back to actions in our logs. I understand that ...
0
votes
1answer
42 views

Is there any problem using empty salts with PBDKF for this purpose?

The aim is to generate a secure key for symmetric encryption. I have a master password, from which I want to generate the key for symmetric encryption, in order to encrypt other passwords. The idea ...
3
votes
2answers
664 views

Determine salt length from hash

I am writing a basic Unix password cracker in Python that would work for MD5, SHA-1 and SHA512. I know that the salt in MD5 correspond to the 2 first chars of the encrypted password, and thus I ...
2
votes
3answers
227 views

Hashing passwords in OpenLDAP

I've seen a few posts on the internet saying most people store user passwords in OpenLDAP using one of OpenLDAP's many, built-in hashing functions. But OpenLDAP itself recommends handing off password ...
8
votes
2answers
199 views

Secure way to shorten a hash

If I want to save a hash of a certain number of bits, but my hashing algorithm gives me more bits than I need, then what is the safest way to shorten it? Should I: Just remove the first or last ...
0
votes
0answers
49 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
1
vote
0answers
240 views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
-4
votes
1answer
62 views

How to find an encryption algorithm between two hexadecimal numbers? [closed]

I have several numbers that are generated by a server. They are 16 digits long and are hexadecimal. I have no idea whether or not any salting or hashing techniques were used. Can I find the encryption ...
1
vote
3answers
55 views

Hashing Algorithms Costs vs Sleep

I understand most of the concepts behind hashing password but this one still escapes me. I understand that you want the hash to take some time ( a couple milliseconds) so the attacker can't ...
27
votes
5answers
4k views

Doesn't hashing passwords server side mean a compromised website could leave passwords vulnerable?

So the traffic is encrypted to a website so the password is safe during transmission and also if the website is hacked then the database only contains hashes. But couldn't the hacker create a server ...
4
votes
1answer
108 views

“MAC function must resist existential forgery under chosen-plaintext attacks”, what does that mean?

While reading about MAC (Message Authentication Code) I have faced this sentence: MAC function must resist existential forgery under chosen-plaintext attacks but I got confused. What does ...
1
vote
2answers
122 views

Double hashing using a relatively new hash and a old, tested one

Note: I am relatively new to cryptography in general, so please point out if I make any misconception here. I heard that you should always use well known crypto/hash functions, that have already been ...
-3
votes
2answers
73 views

When should a password be hashed? [duplicate]

I develop a Smartphone App and have a little question: When should I hash the user passwords, on the device or upload them in plain text and hash them on the server before stored in the database?
8
votes
2answers
463 views

How to store/encrypt fingerprint?

Storing password is a no brainer : use a password hasher. But.. How do you proceed to store fingerprints securely on your server? Meaning that even if your server and all it's data is stolen, someone ...
2
votes
4answers
116 views

Is there a security advantage towards hashing a password on the server? [duplicate]

I'm working on an authentification system. Now in this system the user logs in and sends a hashed password to the server. Is this enough or do I have to rehash the password again? So basically is ...