A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

1
vote
1answer
88 views

Re-sign Certificate Using Different Hashing Algorithm

Consider a certificate used by a Certification Authority. This is currently hashed using SHA-1. I'd like to keep the same public/private key for this, but hash it using SHA-256. By hash it I mean hash ...
6
votes
1answer
303 views

Who in UK I can report to if I know company is storing my password in plain text?

I live in UK, some time ago I wanted to login to my electric company account to check the bill and such, and I had forgotten my password - long story short I got my account locked and had to call ...
1
vote
3answers
42 views

Why are there Hashes next to downloads? [duplicate]

I've seen several sites wehre they would put the hash of the downloadable file next to the file. Why do they do this ? I understand the purpose of comparing the hash of your file with the online hash ...
3
votes
2answers
123 views

Are there any known MD5 hash collisions of messages of different length?

All the examples of MD5 hash collisions I've come across comprise two different messages (inputs) of the same length. The first and second messages have different values for a number of bits and the ...
3
votes
1answer
501 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
2
votes
2answers
92 views

What does it mean to have authentication without confidentiality or authentication without encryption?

I came across these functions m+EeA(H(m)) (for authentication without confidentiality) and m+H(m+k) (for authentication without encryption) and I'm having a bit of a difficult time understanding them. ...
0
votes
1answer
247 views

How to brute-force WPA-2 password of specific set of characters using oclHashcat?

I want to test oclHashcat on a WPA-2 PSK password of length 8 containing only characters in the set {a-z, A-Z, 0-9}. To do this I have already captured the handshake in a .cap file and converted it ...
4
votes
3answers
1k views

Determine hashing algorithm only with known input and output

Given the input: test A system generates the following output hash: 0x001F41B6A0534D3B851D69EFE6237F550100000010D5F4FC65E64BCFDBF2590212E4411C44942C6C734C00ACFE13B958DCAB3614 I do not know ...
1
vote
3answers
162 views

Hash algorithm that provides less than 10 bytes

I know it's insecure, but I need to for number of profile; I need a hash algorithm to provide less than 10 bytes.
0
votes
0answers
42 views

Applocker rules Publisher vs hash

I'm interested in deploying application white-listing for a large scale environment by using the Windows Server built-in AppLocker mechanism. There is no Internet connection to the environment. My ...
-4
votes
1answer
133 views

insecure hash functions

Good hash function should be collision resistant. In 2004 it was shown that MD5 is not collision resistant. As such, MD5 is not suitable for applications like SSL certificates or digital signatures ...
1
vote
2answers
128 views

What is the real advantage of using a “more secure” algorithm like bcrypt for password hashing?

I read this article about password hashing using bcrypt as the recommended method. The advice is similar to what they're saying on hacker news about not using something like SHA2+salt. There are other ...
0
votes
0answers
39 views

Hash function for credit card [duplicate]

Hey PCI and hash expert, What hash function is good for hashing credit card and providing collision resistance? Some context: We are building a tokenization service, so each credit card will have ...
0
votes
1answer
50 views

Unique human view count system without captcha on Pay Per click system, using cryptographic proof of work

I have a system that will be paying users per unique view on a page. I need to prevent 80% of fraudulent automated traffic from being counted. I need to avoid captcha.I would like to implement a ...
1
vote
0answers
63 views

SHA1 and SHA256 initial digest to start from

Let's say I have: C = A + B where A and B contain strings and the plus sign means concatenation. I already hashed A with SHA1 and SHA256 and got a digests. I forget what the original A string was, but ...
1
vote
1answer
144 views

Yii client side captcha validation

Apparently, Yii web application framework generates some kind of hash value from captcha codes it generates and sends it to the client side so it can be used for client side validation of the captcha ...
3
votes
2answers
99 views

Use password to calculate checksum for API requests

I was wondering if it would be an effective way of securing an API by requiring all requests to be checksummed, salted with the users password (or a hashed version)? With securing I mean making it ...
-1
votes
1answer
33 views

Format of hashed strings [closed]

When hashing a string, sometimes I see the format like so: {SHA512}1G2zjh2Bso/LzS06JDLXcELCJX4TQm7oXL5Et3Yg4Veyji7iQW26VnBdEHiURM5evO6duJjzY5387mkWV0oiyYA= Specifically the section indicating the ...
5
votes
2answers
125 views

When can you not use strcmp?

I've read that one shouldn't use strncmp(userSuppliedPassword,origPassword,sizeOfArray) (or String.equals in Java) since one can use a timing attack to guess the password. Rather, one should use a ...
16
votes
4answers
7k views

How quickly can these password schemes really be beaten?

If you use a quick hashing algorithm like MD5 or SHA-1 to hash passwords and you don't use any salt at all, how quickly could one expect a hacker to find my password out? If I use a truly random salt ...
393
votes
5answers
133k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
5
votes
1answer
2k views

Are there any ways to leverage NTLM V2 hashes during a penetration test?

I am on a penetration test at the moment, where LM/NTMLv1 hashes are disabled. I have captured a number of NTLMv2 hashes via NBNS spoofing, however was unable to crack them after running them through ...
17
votes
4answers
2k views

Why would a website serve different versions of a file over HTTP and HTTPS?

Here is a link given on curl's official website: (prefix omitted) bintray.com/artifact/download/vszakats/generic/curl-7.46.0-win64-mingw.7z When I downloaded it with prefixes http:// and https:// I ...
1
vote
2answers
217 views

What if the Local Windows Cert Store is Compromised?

The diagram below illustrates chaining digital certificates up to a publicly trusted Root Certificate: I have been researching how trusted root authorities (such as GlobalSign or Verisign) are used ...
3
votes
2answers
199 views

Hashing password multiple times with different random salts

I have read a lot of answers about this topic like: https://programmers.stackexchange.com/questions/115406/is-it-more-secure-to-hash-a-password-multiple-times. ...
0
votes
1answer
27 views

First string in hash collisions bucket

My understanding of hashing is conceptual at best and I'm assuming things that I'm not sure of and it leads me to a question that I don't even know if it's founded or not. So please correct my ...
5
votes
1answer
110 views

Random string vs hash(random string)?

I'm implementing a one-time token service. Each of these one-time token represents some server side data/action associated with it (a 'email confirm' action for example), so that my web service can ...
3
votes
2answers
82 views

Sign a callback URL

I have a Single Sign-On system that works this way : User clicks link on clientsite.com that redirect him to mastersite.com?returnTo=http://clientsite.com If auth is valid, the user is redirected ...
0
votes
2answers
279 views

Is this hash function safe?

Below is the hash function implementation of the roguewave library. It returns a 32 bit hash. The core operation is A = B ^ ((C << 5) | (C >> 27)). Is this hash safe to use as a password check ...
-1
votes
1answer
64 views

Is there any kind of encryption that returns constant number of characters?

I wonder if there is any kind of publicly known encryption (not hashing) algorithm that generates constant number of characters independent of the input. I have came across an online platform that ...
3
votes
1answer
345 views

John the ripper is not identifying hashes

I'm attempting to use JTR against a password protected zip. I have created the hash file using:zip2john filename.zip > filename.hash and i get a successful output:file.txt is using AES encryption, ...
5
votes
1answer
603 views

Is it bad to add a guessable password to a random password?

Let's say a person has a password they used before they knew about how to make good passwords, like peter123. Let's also say that when they were thinking of a better password, they found they could ...
1
vote
0answers
46 views

trapdoor information with hash functions

I have been playing with an idea for the past few days. I have been unable to find information on here or crypto.stackexchange about using trapdoor information in the input to a hash function. ...
4
votes
1answer
84 views

Unable to get correct base for cracking Crypt3 SHA-512 on Linux with Python

I am reading a book and it gives me a simple Python script to crack /etc/shadow passwords that were encrypted with the crypt() function. It then challenges you to amend the Python program to work with ...
17
votes
2answers
4k views

Insecure versions of crypt hashes

I read at crackstation not to use these variants of bcrypt* ($1$, $2$, $2a$, $2x$, $3$),but I've used bcrypt ($2a$) in various sensitive implementations recently. Can any security expert clarify why ...
0
votes
1answer
205 views

hashcat hash type, convert sha256 binary to hex

I am attempting to use hashcat to crack a hash that is 32 characters in length. I know the hash is sha256. When i run the following command hashcat -m 1400 binary-hashfound.txt ...
50
votes
13answers
6k views

Sequential identifying string that can't be reverse engineered (the “invoice number” problem)

Let's say I operate a website where you can create cat pictures. I give every cat picture a unique identifier so that it can be shared on social media with http://catpictures.com/base62Identifier. I ...
6
votes
2answers
126 views

If no maximum length is placed on a password, can't collisions occur?

As I was thinking about storing password hashes in a database, it dawned on me that there might be hash collisions if there is no set maximum length for the password being hashed. My understanding is ...
2
votes
3answers
1k views

Key stretching a hash

If I implement a function which hashes the first half of my password with MD5 and the second half with SHA-2 and MD5, is there a security issue when I put these two hashes together to create a 64 ...
3
votes
0answers
180 views

Login details security using salt and hash, and a login role in postgresql

I am coding up the security for a website in express.js and postgresql database. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but ...
1
vote
1answer
26 views

One Input Two Hashes

Suppose I have some password x, and two different hash functions h1 and h2. I can then compute the hash y1 = h1(x) and y2 = h2(x). Is there any sort of vulnerability in this case? More ...
-1
votes
2answers
61 views

How secure is a hash + reverse(hash)?

From what I know there is a method called salt added to hashes in order to prevent attackers from using pre-computed hashes. As long as the attacker can find a static salt in reverse hashing and do a ...
8
votes
3answers
822 views

Downloaded file checksums

More than often next to the download button of a file there is a variety of checksums. When I download a file what security risks am I exposed to if I don't check for its integrity?
20
votes
6answers
4k views

Can any password hash ever be secure?

My understanding is the the main reason MD5 is insecure, is that it can be calculated too quickly, allowing too many attempts to be tried. People recommend instead using a hash that has been designed ...
1
vote
0answers
56 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
-2
votes
1answer
86 views

Unconditionally Secure Authentication

I'm trying to add the authentication for my One-Time Pad implementation. I know that to provide Unconditionally Secure Authentication I need to use the One-Time MAC authentication. But I don't ...
34
votes
4answers
4k views

Does every hash value have an inverse value?

There are many different hash functions, md5, sha, and others. They take a value V and produce a H via transformation Function(V) = H, where Function is md5, sha, etc. My question is: Does every hash ...
0
votes
0answers
32 views

Malicious node in distributed hash table (Tor)

I'm thinking about the DHT in Tor that is used to look up hidden services. Namely, if you were running a node in the Tor DHT system, 1) Could you realise that you were storing the data for a nasty ...
19
votes
2answers
2k views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
1
vote
0answers
192 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...