A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

5
votes
1answer
600 views

Is it bad to add a guessable password to a random password?

Let's say a person has a password they used before they knew about how to make good passwords, like peter123. Let's also say that when they were thinking of a better password, they found they could ...
1
vote
0answers
45 views

trapdoor information with hash functions

I have been playing with an idea for the past few days. I have been unable to find information on here or crypto.stackexchange about using trapdoor information in the input to a hash function. ...
4
votes
1answer
77 views

Unable to get correct base for cracking Crypt3 SHA-512 on Linux with Python

I am reading a book and it gives me a simple Python script to crack /etc/shadow passwords that were encrypted with the crypt() function. It then challenges you to amend the Python program to work with ...
0
votes
1answer
180 views

hashcat hash type, convert sha256 binary to hex

I am attempting to use hashcat to crack a hash that is 32 characters in length. I know the hash is sha256. When i run the following command hashcat -m 1400 binary-hashfound.txt ...
6
votes
2answers
124 views

If no maximum length is placed on a password, can't collisions occur?

As I was thinking about storing password hashes in a database, it dawned on me that there might be hash collisions if there is no set maximum length for the password being hashed. My understanding is ...
50
votes
13answers
6k views

Sequential identifying string that can't be reverse engineered (the “invoice number” problem)

Let's say I operate a website where you can create cat pictures. I give every cat picture a unique identifier so that it can be shared on social media with http://catpictures.com/base62Identifier. I ...
1
vote
1answer
25 views

One Input Two Hashes

Suppose I have some password x, and two different hash functions h1 and h2. I can then compute the hash y1 = h1(x) and y2 = h2(x). Is there any sort of vulnerability in this case? More ...
-1
votes
2answers
59 views

How secure is a hash + reverse(hash)?

From what I know there is a method called salt added to hashes in order to prevent attackers from using pre-computed hashes. As long as the attacker can find a static salt in reverse hashing and do a ...
8
votes
3answers
820 views

Downloaded file checksums

More than often next to the download button of a file there is a variety of checksums. When I download a file what security risks am I exposed to if I don't check for its integrity?
20
votes
6answers
4k views

Can any password hash ever be secure?

My understanding is the the main reason MD5 is insecure, is that it can be calculated too quickly, allowing too many attempts to be tried. People recommend instead using a hash that has been designed ...
3
votes
2answers
197 views

Hashing password multiple times with different random salts

I have read a lot of answers about this topic like: https://programmers.stackexchange.com/questions/115406/is-it-more-secure-to-hash-a-password-multiple-times. ...
1
vote
0answers
53 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
-2
votes
1answer
84 views

Unconditionally Secure Authentication

I'm trying to add the authentication for my One-Time Pad implementation. I know that to provide Unconditionally Secure Authentication I need to use the One-Time MAC authentication. But I don't ...
5
votes
1answer
104 views

Reviews of Argon2

I am not a security guy but just curious about the things here. I have seen several people in various answers here talked about the password hashing competition. Now that the winner is announced, I ...
0
votes
0answers
31 views

Malicious node in distributed hash table (Tor)

I'm thinking about the DHT in Tor that is used to look up hidden services. Namely, if you were running a node in the Tor DHT system, 1) Could you realise that you were storing the data for a nasty ...
34
votes
4answers
3k views

Does every hash value have an inverse value?

There are many different hash functions, md5, sha, and others. They take a value V and produce a H via transformation Function(V) = H, where Function is md5, sha, etc. My question is: Does every hash ...
18
votes
4answers
4k views

Have weaknesses in SHA-1 and MD5 ever actually been successfully used in an attack?

Pretty much every guide, how-to, and reference for dealing with passwords and hashing has a warning in big or bold letters stating something along the lines of: SHA-1 and MD5 are NOT secure and ...
1
vote
0answers
172 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...
0
votes
1answer
53 views

Software activation “by phone” [closed]

I'm a software developer, and I would like to protect my application in an offline way, like many software do activating by phone. Following a screenshot taken from google images on what I would like ...
0
votes
0answers
43 views

Generation of the primes p,q and g for DSA using an Hash Function in OpenSSL

We can generate primes p,q and g for DSA in OpenSSL by using command: openssl dsaparam -text -out dsaparam.pem 1024 Is it possible to generate primes p , q and g using an Hash Function in OpenSSL ...
1
vote
1answer
193 views

Decoding base64 encoded message with a key [closed]

I am pentesting a database that where I found data which was base64 encoded. I tried the usual method of decoding base64, which didn't work. Later, I found in database a field called ...
1
vote
1answer
67 views

PBKDF2 constants

I recently found this PBKDF2 code: <?php /* * Password Hashing With PBKDF2 (http://crackstation.net/hashing-security.htm). * Copyright (c) 2013, Taylor Hornby * All rights reserved. * * ...
13
votes
2answers
2k views

Are SHA-2 certificates considered obsolete, or current?

A guide on this site on how to make a decent Certificate Signing Request (CSR) says that I should be using SHA-2 certificates to secure a HTTPS webserver. Are SHA-2 certificates considered obsolete, ...
3
votes
1answer
101 views

Md5 vs Md4 recognition

Is there a way to actually find out whether a hash is MD5 or MD4? For instance: 10c7ccc7a4f0aff03c915c485565b9da is an MD5 hash be08c2de91787c51e7aee5dd16ca4f76 is an MD4 hash I know that there ...
1
vote
3answers
219 views

Hash for secure file downloads? [closed]

Is there any hash structure that can be used for secure download of a file and validation of its contents? Looks like all hashes like MD5 are made for consistency check and are vulnerable to hash ...
-1
votes
2answers
117 views

Using a password hash…as the password? [duplicate]

Ok, this is probably a really stupid idea, but I can't really see why it would be a bad idea. Maybe someone can enlighten me. Why couldn't you enter a password good hashing algorithm like bcrypt, ...
0
votes
1answer
162 views

How can I detect if hashes are salted? [duplicate]

Is it possible to detect hash function of a hash if I don't have access to PHP code? I know that if a hash is some kind of MD5, but I don't know if there is salt etc.
3
votes
1answer
65 views

Does salt increase security if there is only a single hashed password?

Say there is only a single hashed password in the passwords file. If it was salted, would that make it more secure? My logic is: Yes because SALT helps protect against rainbow tables and dictionary ...
6
votes
2answers
54 views

Is there an entropy difference between hashing an encoded string?

Of course if I apply (for example) SHA-2 to a base64 encoded string it will give me a different result versus the original data, but from a strength-perspective in terms of entropy, is there a ...
4
votes
4answers
161 views

Must an encrypted hash value be bigger than the password it was generated from?

I was reading a book called Introduction to network security theory and practice, and I found the following paragraph: Rainbow Tables A rainbow table is a table of two columns constructed as ...
5
votes
2answers
160 views

How to check if your Android app was updated by MitM?

As I was browsing on my phone yesterday, a gray popup appeared on my screen just as I was swiping up, and I accidentally hit the accept button. In the fraction of a second it was on I was able to read ...
8
votes
3answers
2k views

Is it easier to get the original password if you have multiple hashes of it, all created with the same hash function?

If you have multiple hashes of a password, all hashed with the same hash function, is it possible to use this to speed up retrieval of the original password in any way? (I found the question "is it ...
5
votes
1answer
971 views

Should I be worried about brute-forcing passwords that encrypts AES?

I am building an application that needs to locally store sensitive data, that is encrypted using the sha256 of a password provided by the user. It uses AES for encryption. I am worried that some ...
2
votes
1answer
81 views

Why hashing algorithms in layer 2 are weak? [closed]

It's known that hashing algorithms such as md5 and SHA1 are weak and can easily be cracked. I wonder why many layer 2 and 3 devices such as cisco switches still use weak hashing algorithms but don't ...
5
votes
1answer
117 views

If I obtained a username and the salted password pairs from a server, can I login?

I am studying Salted Challenge Response Authentication Mechanism (SCRAM). According to the description at https://tools.ietf.org/html/rfc5802#page-8 it seems that the Client does not have to know ...
42
votes
12answers
10k views

Is there any real value in hashing/salting passwords?

I look after a system which holds a lot of "low grade" information, nothing financial but name/address/email etc. Someone has suggested that we up the security from the current in house password ...
4
votes
1answer
280 views

How could a publicly available stream cipher (RC4) be kept secret so long?

I'm reading about the cryptographic function called RC4. Apparently, its method was kept secret from 1987 until 1994 despite being available to the public for licensing and use. How did it stay ...
0
votes
2answers
662 views

Why can't an n-bit hash be cracked by hashing every single n-bit plaintext?

I'm wondering why it's so hard to find collisions for cryptographic hashes. Take for example a hash function that outputs a 64 bit hash. In order to find collisions, if you feed the function every ...
1
vote
2answers
106 views

Why is finding a strong collision only half the work of a weak collision?

Regarding hash collisions, an attacker only has to do half of the work to find a collision when they can control both messages compared to when they are trying to find a weak collision. This can be ...
3
votes
1answer
437 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
3
votes
2answers
229 views

Why does LastPass store password hashes on the server at all?

While reading about LastPass' breach, I was wondering why would LastPass store strengthened password hashes at all on the server side? Could they only store the AES encrypted data and when the user ...
0
votes
0answers
76 views

Hashing Identifiers to Create Pseudonyms

I'm wanting to share datasets between two organisations in a pseudonymised way such that they link together via mutual entities (e.g. people) but so that the entities cannot be identified. E.g.: ...
3
votes
3answers
245 views

Question regarding MAC and encryption

I was reading the chosen answer to the following question - "MAC vs Encryption" They say that just using encryption, "an attacker could alter the ciphertext to make it say something else when ...
5
votes
1answer
95 views

Salting/Hashing a password

I don't have a security background, so I'm not sure on the best approach for this, I'm developing an android app which users will need to login to (all local). I'm going to store the password in a ...
2
votes
2answers
90 views

which encryption is used in this JS Variables

Which encryption method is used for these variable names: var g_license_info var g_server_time_obj Respectfully encrypted to: var ago05b4e111efe149737a67a177f00ffad2 var ...
4
votes
1answer
102 views

A predictable password generator for offline clients

I know this sounds like pretty dumb question. Why would you use a password generator at all if it's predictable. But suppose you have a server and client - the server always requires a password and ...
3
votes
0answers
104 views

How far should I go in protecting a user's SMBIOS UUID?

My server will be receiving data from several hundreds of computers. As part of keeping track of which computer sent what, I will be fingerprinting the hardware and keeping the results in my database. ...
4
votes
1answer
196 views

Why is Windows password security designed this way? [duplicate]

Let's start with the LM hash. The LanMan hash had MONUMENTAL security flaws, like the password being case insensitive (converted to upper), which reduced the keyspace for a brute force attack. On top ...
0
votes
1answer
189 views

Is this a good hash function?

unsigned int hash(bytearray[] msg) { unsigned int hash = 0xDECAFEBAD; for(i = 0; i < msg.length(); i++) { hash = ((hash << 4) XOR (hash >> 28)) XOR msg[i]; } return ...
5
votes
2answers
579 views

Why not slightly modify an existing hashfunction to create your own? [duplicate]

I read this interesting question on why improvising your own Hash function out of existing hash functions is bad. However this is specifically focusing on 'mixing' existing hashfunctions. What if for ...