A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

8
votes
6answers
933 views

Does repeating one word to form a password result in a similar pattern in its encrypted format?

If i use a single word to form a password by repeating it like the examples below: securesecuresecuresecuresecuresecure SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe ...
7
votes
2answers
1k views

Is it bad practice to ask only for individual characters of a password? [duplicate]

Some financial websites that I use use passwords in a peculiar way. Instead of asking me the whole password string, they only ask me to enter e.g. "3rd, 5th and 8th character of your password", i.e. a ...
7
votes
3answers
763 views

How should I choose a difficulty factor for my password hashing function?

Assuming that I'm doing password hashing properly and using bcrypt, scrypt or PBKDF2, how should I go about choosing an appropriate difficulty factor? i.e rounds for bcrypt, iterations for PBKDF2 and ...
6
votes
2answers
2k views

Truncating the output of SHA256 to 128 bits

suppose we need/prefer 128 bit hash output. for example to generate a 128 bit encryption key or, in other applications (e.g. file integrity verifications), to consume less storage space. i don't know ...
6
votes
8answers
2k views

Does truncating the cryptographic hash make it impossible to crack?

I store password hashes in their full value for example, $h = sha256('foo') outputs 64 characters: 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae I store that directly in the ...
6
votes
2answers
643 views

Implementing Secure Remote Password: Constructing the verifier

The SRP protocol as described in RFC 2945 generates the password verifier: x = SHA(<salt> | SHA(<username> | ":" | <raw password>))` v = g^x % N I have three questions: why use ...
4
votes
1answer
157 views

How can I extract the hash inside a encrypted PDF file?

As long as I know, the encrypted PDF files don't store the decryption password within them, but a hash asociated to this password. When auditing security, a good attemp to break PDF files passwords ...
3
votes
2answers
379 views

Why is a CSR hashed?

What are the use cases for defining something other than the default SHA1 hash in a CSR? Is it to protect the digital signature, public/private keys? What is it protecting exactly?
3
votes
1answer
200 views

Hashed passwords for NTLM authentication

I understood that Windows users' password hashes can be exported very easily. Right? So my question is: If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't ...
3
votes
3answers
481 views

Rainbow Tables: What is the Reduction Used for?

This is a follow up from this answer. The answer is very good, and it put me to thinking and doing some research. I have found another good explanation on this site. At some point, the author says: ...
3
votes
3answers
287 views

Does the hash change the security of the Secure Remote Password protocol?

I'm implementing the Secure Remote Password protocol, and similar to this question, I'm wondering if I can use the SHA-512 hash function instead of SHA-1 currently being used. Would this help improve ...
3
votes
1answer
1k views

How to implement WSS UsernameToken when password on the server is salted and hashed?

I'm currently trying to write a web service for customer and requirement is to use WS Security. On their server side, they have passwords stored as SHA-1(salt+password). According to WSS spec, ...
3
votes
2answers
428 views

What is considered a reasonably high iteration count?

I copy-pasted a function that implements the PBKDF2 hashing algorithm in PHP. The function asks for the amount of time that I would want it to loop in order to produce a hash. Now, I'm wondering, ...
2
votes
2answers
111 views

Reducing hash output length [duplicate]

I am using output of (keyed) hash function to make sure the input was not modified, I store it along with input. Now output of SHA-1 is 20 bytes. Say I want to reduce the output. And have it output 10 ...
2
votes
1answer
123 views

Why do major sites(Facebook, Google, etc) still send passwords unhashed? [duplicate]

QUICK SUMMARY: It seems like modern websites, for security's sake, should all have the client hash their own passwords before sending them to the server, who will rehash them, in order to avoid ...
2
votes
2answers
79 views

Should security phrases be hashed?

I didn't think of this before but today I just realised that in soke sites, pw recovery is possible if you know the answers to security questions like What is your mother's maiden name? In this ...
2
votes
2answers
301 views

Keepass Dictionary Attack Protection Strategy

Though pretty interested, I'm everything but an expert in Information Security, please redirect me to any helpful resources if my question is stupid or correct me if my assumptions are wrong. When ...
2
votes
1answer
551 views

What is the collision chance of a 128-bit hashing function if it is always fed with 256-bits of data?

I mean "normal" collisions not based on any attack. How do i calculate it?
2
votes
2answers
719 views

Does it make any difference of the order Hashing and Encrypting in terms of security?

I am implementing a password vault program with java. I have programmed a triple DES for encryption and a SHA256 for hashing. My question is would it make any difference if I first hash the raw data ...
2
votes
1answer
284 views

Legality and ethics of cryptanalysis on password hashes

I'm working on my dissertation concerning cryptanalysis on password hashes. I'd like to delve into the legal and ethical aspects of cryptanalysis, however, seeing as I'n not at all well versed in law ...
2
votes
1answer
1k views

Using John the Ripper to crack SHA hash w/ partial knowledge

Group, I have a SHA1 hash that I would like to brute-force. I have knowledge of several characters before and after the password (ie, if the hash is derived from "xxxpasswordyyy", I know both xxx and ...
1
vote
2answers
155 views

Should hashing hashed hashes colide or not?

Since key stretching basically boils down to hashing hashes over and over again (where salt, pepper and password individualize the hash function, but the principle remains the same), I wonder about ...
1
vote
1answer
343 views

How to check for a key *and* store encrypted data?

I wish to create a system wherein I store encrypted data. Users can access this data if they have the key. If they give a wrong key, they don't get access at all. If they give the right key, they get ...
0
votes
3answers
189 views

Testing a password for similarity to previous hashes

This question is a follow-up to a comment by Tobias Kienzler to an answer to "What is the purpose of the “Password minimum age” setting?". Consider a password policy that new passwords cannot be ...
0
votes
0answers
72 views

How much risk is introduced by git's signing the commit hash rather than the blobs? [duplicate]

Since first switching from centralized VCS systems to a decentralized one—specifically git—I have properly understood that that git's commit ID's were hashes of the included objects and some meta data ...
0
votes
2answers
80 views

Why RSA signatures based on the hash of the message? [closed]

Why RSA signatures based on the hash of the message rather than the message itself?
0
votes
2answers
169 views

Why do file storage sites have a long unique id for their download links?

I'm creating a file storage site and what I would do is just have the download links format as: https://www.domain.com/[id]/[file name] //id would just be 1, 2, 3 etc. Dropbox and many others have ...
0
votes
0answers
34 views

Hashing / How easy is it to infer the original input if the a slight variation of the input, the hash result and the hashing algorithms are known [duplicate]

Given that I have an initial input that is publicly known (e.g. "ABCDEFGHIJ") a slight variation of (1) (e.g. "BACDEFGHIJ") that is used as the input to a hashing algorithm (3) an modern one-way ...
0
votes
1answer
111 views

Using multiple hash-functions along the line [duplicate]

I was wondering what the effect on strength/security is If I would use an aggregate of multiple hash-functions. For instance, I don't want to sent passwords in plain text (although it's over an ...