A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

-4
votes
2answers
241 views

the Informix password crack

I get some hash like: username sowainformix salt 7307821250330563328 hashed_password HaHvvzanjp_lPZgHLu0KHquN.Q4t98EF48csXk1QTJs hash_type SHA-256 updated flags ...
0
votes
1answer
352 views

Is this password hashing + salt method the most secure way possible? [duplicate]

I am just wondering what all the security experts think of my method for password hashing. I want to come up with a method I can use for all my future web development projects. First I create a ...
3
votes
1answer
431 views

Reverse-engineering password salts

Lets set out a scenario, a database has been dumped and all the passwords are hashed. You notice that some users seemed to have signed up twice and have the same hash. You run these hashes through ...
3
votes
2answers
269 views

comparing password hashing algorithms - PoC ideas?

OK so I just started working for a security consulting firm and we recommend SHA 256 (with salt) for password hashing because MD5 is too weak. I have read some brilliant answers (the list is too ...
0
votes
1answer
66 views

Payload authentication + HW-SW Binding

I want to authenticate a (2nd stage) bootloader during the boot process using a symmetric key, which is derived from HW properties of the platform the bootloader is running on. Thus, I want to bind ...
0
votes
2answers
120 views

Would multiple exposed bcrypt hashes of the same UUID v4 with random generated salt be too insecure?

I'm looking into implementing an ownership check on JSON objects and want to avoid going back to the database to ensure ownership of said object/record (i.e., to prevent a user from updating an ...
0
votes
2answers
359 views

Does using Bcrypt to encrypt credit card numbers satisfy PCI compliance?

I understand that using MD5 is not safe and is not PCI compliant. Does using BCrypt satisfy PCI compliance
9
votes
4answers
483 views

How can I be secure with a global salt?

If I understood the basic of password hashing and storing, what we need are: a "strong" salt a "real" random salt a unique salt per password a password hashing function with a high CPU cost We ...
0
votes
1answer
198 views

The Hash header in GPG ASCII armor

When sending a signed message using GPG, it always includes a line that says Hash: SHA256 right at the top of my email. I was wondering if/why it's required, and if not, how I can remove it (in an ...
13
votes
2answers
2k views

What are the most common password salting methods?

I learned that the Sun guys used the login name as salt for password hashing. Is this a common approach? What are the most common salt values?
6
votes
2answers
497 views

Implementing Secure Remote Password: Constructing the verifier

The SRP protocol as described in RFC 2945 generates the password verifier: x = SHA(<salt> | SHA(<username> | ":" | <raw password>))` v = g^x % N I have three questions: why use ...
15
votes
2answers
3k views

Why is it always `HASH( salt + password )` that we recommend?

Browsing over this site, many forums, online articles, there's always one specific way we're suggesting to store a password hash: function (salt, pass) { return ( StrongHash(salt + pass) ) } But ...
0
votes
2answers
276 views

Algorithm to generate NTLMv2 Hash in PHP

I am trying to develop a PHP function to calculate NTLMv2 hash by providing server & client challenge, domain, account and password. The resulting hash appears to be not correct. Can someone ...
5
votes
4answers
483 views

Secure authentication: partial client-side key stretching… please review/criticize my idea

I am trying to figure out what would be the 'perfect' authentication system for a website. On one end, we know that simple hashing algorithms can be brute-forced or cracked in other ways. Hence why ...
1
vote
2answers
251 views

Could a user never store a password if a username/email hash was used instead?

So I was just thinking about token_authenticatable setup from devise (rails gem), and this thought occurred to me: Could we strengthen web security by hashing username/password with javascript before ...
0
votes
1answer
184 views

Challenge, Authentication and session key

I programmed an application on Linux using C, I added an authentication and cryptography layer that's going like this : 1 -client sends connection request. -server send a random challenge to client. ...
0
votes
1answer
1k views

John the ripper passwd file format with salt not working

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is: $hash = md5($salt . $pass) No other ...
10
votes
4answers
991 views

How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?

I'm new to cryptography and its implementations. I'm designing an Android app where an user enters a password to retrieve some encrypted data. After some research on possible solutions I ended up with ...
212
votes
12answers
33k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the ...
3
votes
2answers
302 views

Is there any way to cryptographically hash a human thumbprint?

Is there any way to cryptographically hash a human thumbprint into a form that can be consistently reproduced by thumbprint readers? Assuming that it would be possible to create a database of ...
24
votes
2answers
7k views

HMAC - Why not HMAC for password storage?

Nota bene: I'm aware that the good answer to secure password storage is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. Let's say ...
9
votes
2answers
591 views

Does it make sense to choose a longer password than the output of a hash?

Let's take MD5 for example: It outputs a 128-bit hash. Does it make sense (in theory) to choose an input (password) which is itself longer than 128-bit? Does it increase the probability of a ...
0
votes
2answers
709 views

Finding out whether a website uses unsalted MD5 for password hashing

I'm working on a project where websites are analyzed and rated according to password security (factors like min/max password length, alphabet size and more are then calculated into a score). A great ...
7
votes
4answers
472 views

How can we factor Moore's law into password cracking estimates?

How would we go about factoring Moore's law into exceedingly long password cracking estimates? Let's say we've got a 12 character password containing mixed-case alpha characters and numbers, i.e. ...
10
votes
4answers
1k views

Is there a length beyond which increasing password length provides no additional security?

Assuming that the password is stored hashed and salted, and that it is a string of random characters, is there a point where adding to password length doesn't add security? Since the hash will have a ...
4
votes
3answers
179 views

Would secure storing of past used/generated passwords be a good idea?

Let's assume an organisation that generates ~100 Passwords a week; these Passwords are 32-Characters long and randomly generated. The consultants that need passwords generated use a Password-generator ...
1
vote
2answers
192 views

How can I generate a unique SALT for multiple apps sharing one user database?

Let's say that I have one Database, and several separate web applications that share the database. If hashes are to be unique and generated on the server-side, how can I ensure that I am generating a ...
3
votes
1answer
477 views

Hashing passwords before inserting into database

For the last 2 weeks I have been reading many blogs about website security and hashing passwords. Many sites have mentioned the pro's and cons about different ways of doing this, which has left me a ...
6
votes
3answers
149 views

Is it safe to store hashes of possibly non-existing passwords in a less safe way?

I would like to implement a lockout mechanism that not only protects against same username and many passwords attacks, but many usernames and same password attacks too. To implement this I figured I ...
4
votes
2answers
388 views

What is the purpose of a Pepper?

I've been trying to find out exactly what a pepper is. The only things I could accurately determine are that a Pepper: Is theoretically unique from site to site and hard-coded in the site's source ...
3
votes
5answers
263 views

Are hash functions “strongest link”?

It seems to me that if you were to use multiple hash functions, the "strongest link" would hold up the others. For example: HelloWorld --- md5 --> 68e109f0f40ca72a15e05cc22786f8e6 --- sha256 ...
22
votes
8answers
2k views

Why is password hashing considered so important?

After reading this article, I can see the benefits of password hashing as a second layer of defence, in the event of an intruder gaining access to a password database. What I still don't understand is ...
53
votes
5answers
19k views

Password Hashing add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
0
votes
3answers
143 views

Devising encryption schemes and protocols

I am wondering how encryption schemes are developed and why certain decisions are made. For example. I have seen a company hash a string with SHA1 and then RSA encrypt it. Why? I've also seen the ...
0
votes
2answers
806 views

how to know what hash function have been used

I have a hashed password and the plaintext password and i want to know the exact algorithm that's been used. I have the input and the output of the hash/encription algorithm. How would I know what ...
1
vote
3answers
425 views

Password Security and ocl-Hashcat-plus

I recently read the Ars Technical Article about new features in ocl-Hashcat-plus. In light of questions like: Long Passwords: How are they more secure? and XKCD #936: Short complex password, or ...
230
votes
4answers
65k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
2
votes
4answers
198 views

Why do some passwords not allow certain types of characters?

Is there any programing related reason why some password cannot have certain characters? If the idea in storing a password is to store it's hash, since a hashing function can take any input (ok at ...
1
vote
1answer
121 views

Is double hashing bad? [duplicate]

I hear rumors that double hashing is bad... like hash("sha512", hash("whirlpool", "string")) Is it bad and less secure? if so why? Thanks for any help!
2
votes
4answers
727 views

Using only password to authenticate user (no “username” field)

I am creating a client access system, to allow manage invoices, make payments, access information about their products and information/functionality alike. Supposedly there are less than 1000 ...
6
votes
2answers
329 views

Salt placement prior to one-way hash

In one-way hashing its common to prepend or append the salt to the secret and then hash it: (salt + secret) or (secret + salt). I was thinking of this metaphor as salt falling on a plate of food. It ...
10
votes
4answers
1k views

How secure is the SRP that Blizzard uses to protect passwords?

Blizzard very recently announced that their network was compromised, but they assure users in their statement that the password information that the attackers had access to was saved in a secure way: ...
0
votes
3answers
187 views

Need references about why public access to a password hash and salt is poor practice

What are some published industry standards about why revealing the password hash and salt are poor or bad practices from a security perspective? I am dealing with a vulnerability where anyone can ...
2
votes
3answers
200 views

Is there any reason I shouldn't use SHA1 of salt + website name + master password for my password in websites?

I considered writing a program to do the above for websites I only intend to use for short-term use.
-3
votes
3answers
895 views

Generating an unguesable token for confirmation e-mails

I'm generating a token to be used when clicking on the link in a verification e-mail. I plan on using uniqid() but the output will be predictable allowing an attacker to bypass the confirmation ...
2
votes
1answer
187 views

Unknown encryption string [closed]

I'm trying to learn about encryption and decryption methods when I faced this string: {MD5}JfnnlDI7RTiF9RgfG2JNCw== MD5 is 16-byte string, so anyone know what type of encryption is this and why ...
3
votes
2answers
341 views

Is mt_rand() suitable for generating a salt?

Assumed I have to following code in order to generate a random blowfish salt for saving a new password: $blowfishCharacters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./'; $salt ...
16
votes
1answer
291 views

What's this kind of authentication scheme called?

In the past I've heard about a scheme to prove your identity online in places like forums, without having to create an account. When posting, the user would enter a password which is then heavily ...
4
votes
4answers
302 views

User password as key instead of hashing it

I was reading here on Hashes and Salts and I thought about another method to do user authentication. I need your thoughts on this as I might be overlooking something. Scenario: For web application ...
13
votes
7answers
989 views

Why should I hash passwords?

I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it? When a ...