A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

2
votes
3answers
66 views

Why do websites use less effective hash functions? [duplicate]

When releasing, say, ISO files, the websites usually provide the supposed hash of the ISO to compare with, to verify its integrity. Or, to prove that it at least probably wasn't tampered with. But on ...
169
votes
8answers
38k views

Why are salted hashes more secure for password storage?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...
0
votes
1answer
90 views

How can I ensure that only the message I sent, and nothing else reaches the receiver?

How do I make sure that the open channel I use to send a message to a specific receiver, is not used by a third party to send unwanted files and compromise the receivers system? Is there a method by ...
152
votes
11answers
57k views

Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?

Why can't a password hash be reverse engineered? I've looked into this ages ago and have read lots on it, but I can't find the explanation of why it can't be done. An example will make it easier to ...
1
vote
3answers
120 views

Signatures for an antivirus

When anti-virus software compares an MD5 signature for malware, does it execute the malware on my computer in order to generate the appropriate signature to compare against? [ORIGINAL QUESTION] MD5 ...
2
votes
3answers
198 views

Parameters for PBKDF2 for password hashing

I use PBKDF2 with SHA-256 to store hashes of passwords. I use the following parameters: number of iterations desired = 1024 length of the salt in bytes = 16 length of the derived key ...
12
votes
2answers
4k views

Estimating the size of a rainbow table

What are rainbow tables and how are they used? Gives a very precise answer about what rainbow tables are and how they are used. I had always confused hash-tables and rainbow tables. My question is ...
0
votes
3answers
97 views

How does encryption force a processor to “pause”?

I'm often told that encryption forces processors to "make a pause" when performing the math to decrypt a hash, which is why brute forcing can take so long. I don't understand what it means for a ...
25
votes
4answers
6k views

Why are MD5 and SHA-1 still used for checksums and certificates if they are called broken?

I was just reading about SSL/TLS stuff, and according to this site (which is rated as A by Qualys SSL Labs), MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And yet, I noticed ...
36
votes
15answers
7k views

Why do people think that this is bad way to hash passwords?

Well, please tell me, what's wrong with this code: $password = "hello"; $password = md5($password); for($i=1;$i<20;$i++){ $password = md5($password); } It's exactly the same as this one: ...
5
votes
2answers
143 views

Why are we using SHA3-512?

As we know, hash algorithms can be used for authenticity of a message. In my understanding, since the message lengths are too large, we convert it into a hash value using hash algorithms and these ...
1
vote
0answers
115 views

Can password hashing both client side and on the back end improve security if we don't necessarily trust the server? [duplicate]

I want to know if it ever makes sense to hash a password client side and rehash it again on the back end. I've not seen this done before which makes me suspicious as to whether it really does add ...
0
votes
2answers
248 views

Breaking encryption with hash value of password?

Can you break an encrypted volume if you know the source code of the crypto-tool used and the hash value of the secret passphrase? Why is it not possible to just reverse engineer the passphrase ...
-7
votes
2answers
5k views

Is AES slower to encrypt than MD5?

Is this the right interperation of this diagram: http://www.cryptopp.com/benchmarks.html AES/CCM MiB/Second:61 Cycles Per Byte:28.6 MD5 MiB/Second:255 Cycles Per Byte:6.8 And does that ...
0
votes
0answers
15 views

Is encryption with a destroyed key a good cryptographic hash function? [duplicate]

Obviously this isn't something I was going to implement, but it was a question floating at the back of my mind. So let's say that instead of hashing passwords to store in the database, you encrypt ...
20
votes
6answers
5k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
-2
votes
2answers
185 views

How to securely transfer password from a registration page to the database [duplicate]

What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http) when the user registers for the first time on ...
4
votes
2answers
192 views

Location of Password Hashes on a Windows Local Machine?

"Where are the two locations that user's password hashes are stored on a local windows machine?" My place of business asked me this question. I know that the SAM stores password hashes, where would ...
13
votes
2answers
370 views

Can client-side hashing improve after-the-fact security in response to password leaks?

Several questions on this site address client-side password hashing, and none of them admit to any security benefit beyond protecting other sites the user might use the same password for. However, ...
-7
votes
2answers
260 views

What is is the best way to create virus signature database? [closed]

We are thinking to develop a new Antivirus program. The main concern is to create a virus signature database. I want to ask what is the best possible way to add viruses signature in our database to ...
27
votes
10answers
5k views

Could I recover the content of file from its checksum/hash?

Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file. Now assume ...
1
vote
0answers
39 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
8
votes
2answers
104 views

Is there a threshold of bits of entropy below which hashing becomes meaningless?

I just read a help page by a mail provider in which they state that all mobile phone numbers will be stored as a salted hash. This strikes me as interesting, since phone numbers don't contain a lot ...
2
votes
3answers
134 views

Verify password hashed with nonce when the password is already hashed on the server?

I found this picture in the Wikipedia nonce article: To avoid sending the password in clear text and prevent replay attacks, the password is hashed together with one random number from the server (...
1
vote
3answers
152 views

why not use hashed password as password [duplicate]

Why dont we use our mobile phone tho hash a password and then enter the hash on a website as the password ? This way the password for the website would be much more complex. Would this even increase ...
1
vote
1answer
83 views

Protecting email addresses if their hashes are publicly avaliable

I am working on a project, where user email address hashes will be available publicly, and I need to prevent them from being quickly discovered by spammers. The main idea of the undertaking is to ...
2
votes
5answers
9k views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
-5
votes
3answers
85 views

how to know the way in which password was encrypted [closed]

i have a encrypted password basically hashed i don't know what it is some thing like 11dfb34b27f539a5e785b68e529fd470 and i know the password i.e., the plain text but i want to know the way that how ...
1
vote
2answers
100 views

Isn't oAuth weaker than traditional passwords

I understand the need for oauth for programmatic access to apis, etc. whereas passwords are used for more human-level authentication. However when we store passwords, we (hopefully) salt + hash them. ...
0
votes
2answers
75 views

PGP vs Hash functions

What is the difference (in terms of security strength) between checking a package' integrity using pgp and hashing functions (i.e. sha256)? Isn't pgp less secure as the verifier must trust the ...
-2
votes
1answer
55 views

What reasons for implementing reversibly encrypted data are there? [closed]

Excuse me if I am wrong, as I am very new to the field, but it seems that the only reason one should encrypt something in a reversible way is if the object receiving the encrypted data is a person. (i....
0
votes
2answers
112 views

Using a hash to encrypt data

Lately, I've been reading about cryptography and thought of a method of using hashes to encrypt data. From what I know, hashes are unique to each object and are one way functions. Encryption on the ...
42
votes
12answers
10k views

Is there any real value in hashing/salting passwords?

I look after a system which holds a lot of "low grade" information, nothing financial but name/address/email etc. Someone has suggested that we up the security from the current in house password ...
1
vote
1answer
103 views

Re-sign Certificate Using Different Hashing Algorithm

Consider a certificate used by a Certification Authority. This is currently hashed using SHA-1. I'd like to keep the same public/private key for this, but hash it using SHA-256. By hash it I mean hash ...
6
votes
1answer
308 views

Who in UK I can report to if I know company is storing my password in plain text?

I live in UK, some time ago I wanted to login to my electric company account to check the bill and such, and I had forgotten my password - long story short I got my account locked and had to call them....
1
vote
3answers
42 views

Why are there Hashes next to downloads? [duplicate]

I've seen several sites wehre they would put the hash of the downloadable file next to the file. Why do they do this ? I understand the purpose of comparing the hash of your file with the online hash ...
3
votes
2answers
131 views

Are there any known MD5 hash collisions of messages of different length?

All the examples of MD5 hash collisions I've come across comprise two different messages (inputs) of the same length. The first and second messages have different values for a number of bits and the ...
3
votes
1answer
582 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
2
votes
2answers
95 views

What does it mean to have authentication without confidentiality or authentication without encryption?

I came across these functions m+EeA(H(m)) (for authentication without confidentiality) and m+H(m+k) (for authentication without encryption) and I'm having a bit of a difficult time understanding them. ...
0
votes
1answer
286 views

How to brute-force WPA-2 password of specific set of characters using oclHashcat?

I want to test oclHashcat on a WPA-2 PSK password of length 8 containing only characters in the set {a-z, A-Z, 0-9}. To do this I have already captured the handshake in a .cap file and converted it ...
4
votes
3answers
1k views

Determine hashing algorithm only with known input and output

Given the input: test A system generates the following output hash: 0x001F41B6A0534D3B851D69EFE6237F550100000010D5F4FC65E64BCFDBF2590212E4411C44942C6C734C00ACFE13B958DCAB3614 I do not know ...
1
vote
3answers
174 views

Hash algorithm that provides less than 10 bytes

I know it's insecure, but I need to for number of profile; I need a hash algorithm to provide less than 10 bytes.
0
votes
0answers
49 views

Applocker rules Publisher vs hash

I'm interested in deploying application white-listing for a large scale environment by using the Windows Server built-in AppLocker mechanism. There is no Internet connection to the environment. My ...
-4
votes
1answer
152 views

insecure hash functions

Good hash function should be collision resistant. In 2004 it was shown that MD5 is not collision resistant. As such, MD5 is not suitable for applications like SSL certificates or digital signatures ...
1
vote
2answers
133 views

What is the real advantage of using a “more secure” algorithm like bcrypt for password hashing?

I read this article about password hashing using bcrypt as the recommended method. The advice is similar to what they're saying on hacker news about not using something like SHA2+salt. There are other ...
0
votes
0answers
39 views

Hash function for credit card [duplicate]

Hey PCI and hash expert, What hash function is good for hashing credit card and providing collision resistance? Some context: We are building a tokenization service, so each credit card will have ...
0
votes
1answer
52 views

Unique human view count system without captcha on Pay Per click system, using cryptographic proof of work

I have a system that will be paying users per unique view on a page. I need to prevent 80% of fraudulent automated traffic from being counted. I need to avoid captcha.I would like to implement a ...
1
vote
0answers
64 views

SHA1 and SHA256 initial digest to start from

Let's say I have: C = A + B where A and B contain strings and the plus sign means concatenation. I already hashed A with SHA1 and SHA256 and got a digests. I forget what the original A string was, but ...
1
vote
1answer
151 views

Yii client side captcha validation

Apparently, Yii web application framework generates some kind of hash value from captcha codes it generates and sends it to the client side so it can be used for client side validation of the captcha ...
3
votes
2answers
107 views

Use password to calculate checksum for API requests

I was wondering if it would be an effective way of securing an API by requiring all requests to be checksummed, salted with the users password (or a hashed version)? With securing I mean making it "...