A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

3
votes
1answer
102 views

Md5 vs Md4 recognition

Is there a way to actually find out whether a hash is MD5 or MD4? For instance: 10c7ccc7a4f0aff03c915c485565b9da is an MD5 hash be08c2de91787c51e7aee5dd16ca4f76 is an MD4 hash I know that there ...
1
vote
3answers
229 views

Hash for secure file downloads? [closed]

Is there any hash structure that can be used for secure download of a file and validation of its contents? Looks like all hashes like MD5 are made for consistency check and are vulnerable to hash ...
-1
votes
2answers
129 views

Using a password hash…as the password? [duplicate]

Ok, this is probably a really stupid idea, but I can't really see why it would be a bad idea. Maybe someone can enlighten me. Why couldn't you enter a password good hashing algorithm like bcrypt, ...
0
votes
1answer
196 views

How can I detect if hashes are salted? [duplicate]

Is it possible to detect hash function of a hash if I don't have access to PHP code? I know that if a hash is some kind of MD5, but I don't know if there is salt etc.
3
votes
1answer
66 views

Does salt increase security if there is only a single hashed password?

Say there is only a single hashed password in the passwords file. If it was salted, would that make it more secure? My logic is: Yes because SALT helps protect against rainbow tables and dictionary ...
6
votes
2answers
61 views

Is there an entropy difference between hashing an encoded string?

Of course if I apply (for example) SHA-2 to a base64 encoded string it will give me a different result versus the original data, but from a strength-perspective in terms of entropy, is there a ...
4
votes
4answers
163 views

Must an encrypted hash value be bigger than the password it was generated from?

I was reading a book called Introduction to network security theory and practice, and I found the following paragraph: Rainbow Tables A rainbow table is a table of two columns constructed as ...
5
votes
3answers
213 views

How to check if your Android app was updated by MitM?

As I was browsing on my phone yesterday, a gray popup appeared on my screen just as I was swiping up, and I accidentally hit the accept button. In the fraction of a second it was on I was able to read ...
8
votes
3answers
2k views

Is it easier to get the original password if you have multiple hashes of it, all created with the same hash function?

If you have multiple hashes of a password, all hashed with the same hash function, is it possible to use this to speed up retrieval of the original password in any way? (I found the question "is it ...
5
votes
1answer
977 views

Should I be worried about brute-forcing passwords that encrypts AES?

I am building an application that needs to locally store sensitive data, that is encrypted using the sha256 of a password provided by the user. It uses AES for encryption. I am worried that some ...
2
votes
1answer
81 views

Why hashing algorithms in layer 2 are weak? [closed]

It's known that hashing algorithms such as md5 and SHA1 are weak and can easily be cracked. I wonder why many layer 2 and 3 devices such as cisco switches still use weak hashing algorithms but don't ...
5
votes
1answer
126 views

If I obtained a username and the salted password pairs from a server, can I login?

I am studying Salted Challenge Response Authentication Mechanism (SCRAM). According to the description at https://tools.ietf.org/html/rfc5802#page-8 it seems that the Client does not have to know ...
42
votes
12answers
10k views

Is there any real value in hashing/salting passwords?

I look after a system which holds a lot of "low grade" information, nothing financial but name/address/email etc. Someone has suggested that we up the security from the current in house password ...
4
votes
1answer
281 views

How could a publicly available stream cipher (RC4) be kept secret so long?

I'm reading about the cryptographic function called RC4. Apparently, its method was kept secret from 1987 until 1994 despite being available to the public for licensing and use. How did it stay ...
0
votes
2answers
669 views

Why can't an n-bit hash be cracked by hashing every single n-bit plaintext?

I'm wondering why it's so hard to find collisions for cryptographic hashes. Take for example a hash function that outputs a 64 bit hash. In order to find collisions, if you feed the function every ...
1
vote
2answers
108 views

Why is finding a strong collision only half the work of a weak collision?

Regarding hash collisions, an attacker only has to do half of the work to find a collision when they can control both messages compared to when they are trying to find a weak collision. This can be ...
3
votes
1answer
501 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
3
votes
2answers
243 views

Why does LastPass store password hashes on the server at all?

While reading about LastPass' breach, I was wondering why would LastPass store strengthened password hashes at all on the server side? Could they only store the AES encrypted data and when the user ...
0
votes
0answers
80 views

Hashing Identifiers to Create Pseudonyms

I'm wanting to share datasets between two organisations in a pseudonymised way such that they link together via mutual entities (e.g. people) but so that the entities cannot be identified. E.g.: ...
3
votes
3answers
246 views

Question regarding MAC and encryption

I was reading the chosen answer to the following question - "MAC vs Encryption" They say that just using encryption, "an attacker could alter the ciphertext to make it say something else when ...
5
votes
1answer
100 views

Salting/Hashing a password

I don't have a security background, so I'm not sure on the best approach for this, I'm developing an android app which users will need to login to (all local). I'm going to store the password in a ...
2
votes
2answers
99 views

which encryption is used in this JS Variables

Which encryption method is used for these variable names: var g_license_info var g_server_time_obj Respectfully encrypted to: var ago05b4e111efe149737a67a177f00ffad2 var ...
4
votes
1answer
107 views

A predictable password generator for offline clients

I know this sounds like pretty dumb question. Why would you use a password generator at all if it's predictable. But suppose you have a server and client - the server always requires a password and ...
3
votes
0answers
115 views

How far should I go in protecting a user's SMBIOS UUID?

My server will be receiving data from several hundreds of computers. As part of keeping track of which computer sent what, I will be fingerprinting the hardware and keeping the results in my database. ...
4
votes
1answer
212 views

Why is Windows password security designed this way? [duplicate]

Let's start with the LM hash. The LanMan hash had MONUMENTAL security flaws, like the password being case insensitive (converted to upper), which reduced the keyspace for a brute force attack. On top ...
0
votes
1answer
192 views

Is this a good hash function?

unsigned int hash(bytearray[] msg) { unsigned int hash = 0xDECAFEBAD; for(i = 0; i < msg.length(); i++) { hash = ((hash << 4) XOR (hash >> 28)) XOR msg[i]; } return ...
5
votes
2answers
584 views

Why not slightly modify an existing hashfunction to create your own? [duplicate]

I read this interesting question on why improvising your own Hash function out of existing hash functions is bad. However this is specifically focusing on 'mixing' existing hashfunctions. What if for ...
3
votes
2answers
187 views

How to give “Forgot password” option for a password encrypted file?

I have created a utility that encrypts a file (.txt, .dox, so on...). The utility asks for a password from user at the time of file encryption. Problem Suppose a user has created 1000 encrypted ...
1
vote
2answers
189 views

how to authenticate user in client-server implementation

So I am trying to implement a client-server application for sending files over SSL sockets. And I am trying to decide on a very secure design for authenticating the client. The server is going to ...
5
votes
3answers
170 views

How to prevent a prophecy from becoming self-fulfilling or self-defeating

Let's assume that I have deduced with a high probability what a certain famous person or organization will choose to do at a near-future date. How can I publish any proof of me having deduced this? ...
-3
votes
1answer
94 views

Hash regex for malware recognition [closed]

I'm looking to store two types of hashes for recognizing blacklisted code. These are the FireEye "import hash" (or imphash) and the ssdeep "fuzzy hash". Is there a regex (or formal documentation) I ...
1
vote
1answer
201 views

best practices for storing retrievable passwords

I am trying to build a NMS (network management system) and I am required to store passwords for 3rd party databases, devices and servers that are being managed (not user passwords). These passwords ...
4
votes
1answer
267 views

OpenSSL 0.9.6a PRNG algorithm weakness: How to exploit?

I saw an OpenSSL security advisory for Openssl 0.9.6a Recently a cryptographic flaw in OpenSSL's built-in pseudo-random number generator (PRNG) was pointed out to us by Markku-Juhani O. Saarinen ...
2
votes
2answers
129 views

Best hash for indexing and searching encrypted data

I would like to be able to do database look-ups on a set of data based on one of the encrypted fields. My understanding of the best practice for accomplishing this is to store a hash of the data I ...
1
vote
1answer
144 views

Yii client side captcha validation

Apparently, Yii web application framework generates some kind of hash value from captcha codes it generates and sends it to the client side so it can be used for client side validation of the captcha ...
2
votes
1answer
590 views

Can I know somehow if my password hash is known?

Is there a secure way to know if my password's hash is publicly known on the internet? First I tried to search for it in Hashes.org (http://hashes.org/search.php), but then I suspected, that if it ...
5
votes
2answers
613 views

How facebook knows my new password is too similar to my old password? [duplicate]

I am still very new to Information Security field and as far as I know, websites use hashing algorithm on user's passwords before storing it and they don't know the plain-text password of a user. ...
4
votes
1answer
135 views

Is the 64-bits length of the original string padded as well in the MD5 hashfunction?

So, for example I have a string which binary value is exactly 512 - 64 bits long, so the binary conversion of the string does not have to be padded. So that means I have a string of 56 chars. The ...
1
vote
1answer
43 views

Hashing Based Encryption

Let's say you take a 256 bit key and never use it to encrypt anything. You receive a message with a 16 character unique randomly generated salt pre-pended. You salt your key with the 16 character ...
-1
votes
1answer
69 views

Finding the cryptographic hashing algorithm, given the plain text and the corresponding salted hash [duplicate]

I have a salted hash (say about, 110 characters long) and the corresponding plain text that I used for hashing. As the title says, is it possible to do find the algorithm via crypt-analysis? What is ...
0
votes
1answer
58 views

Store Hash and/or Encryption salts in database [duplicate]

I am doing a custom login for practice purposes, and i am wondering what would be the logical way to save the hashed password and the salts. Salt/Hash operations are using Rfc2898DeriveBytes class. ...
2
votes
1answer
155 views

How to “Pass the hash” when LM hash is disabled?

I ran the NTLM_stealer metasploit module and ended up with the following results: LMHASH:Disabled NTHASH:008940f335e9b2ddc182bb5b960a0c5bad0b125cbee3cf84 I was wondering if there is way to ...
24
votes
1answer
2k views

How can the content of a file refer to its own MD5?

So I just saw this picture on Imgur: http://imgur.com/gxRCrCM The intriguing thing about it is that the picture refers to an old Daft Punk song named "Face 2 Face". The image's MD5 is ...
0
votes
2answers
137 views

Reverse engineering of hash functions

I have an unknown process that gets some vars and returns an 8byte hash. I'm sure which vars it gets and I'm sure these are all the variable parts of the input. I can query this process when and how ...
1
vote
0answers
46 views

Key stretching approaches

I've seen that a number of key stretching algorithms and they involved increasing the number of operations needed to compute the key(i.e. the number of rounds within a hash function). But, I wonder if ...
65
votes
11answers
9k views

Is there any way my password is hashed, if I'm only ever asked to provide 5 out of many characters? [duplicate]

There is a system that, on a login form, presents about 40 boxes for password letters (to hide password's actual length), and only random ones (the same amount each time) are editable. Explanation is ...
8
votes
1answer
671 views

Why store a salt along side the hashed password? [duplicate]

Understand the need to protection credentials with hashes that are expensive and to use cryptographically random salts. What I would like to understand is why you would store the salt along side the ...
0
votes
1answer
50 views

Would it matter if my miner was hashing random vs incremental values?

I'm working on my miner for my "game" site that's basically a pre-image attack from a hash posted online. You submit a hash input, it's hashed, and your score is the hamming distance (the number of ...
2
votes
2answers
1k views

Is it possible to salt the SHA1 or SHA256 hash function of OpenSSL?

I would like to salt the hash function of OpenSSL external, so that I can assign a salt on my own. Is that possible or is the hash function of OpenSSL alsways internal "salted"?
3
votes
1answer
172 views

Challenge: How to find the secret key in homebrew MAC/keyed hash: sha1(key + cookie)?

I am trying to solve a security challenge on a website. Basically, the website computes sha1(key + cookie) to sign a cookie so that the user can't change it himself, and to accomplish the goal you ...