A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

6
votes
3answers
149 views

Is it safe to store hashes of possibly non-existing passwords in a less safe way?

I would like to implement a lockout mechanism that not only protects against same username and many passwords attacks, but many usernames and same password attacks too. To implement this I figured I ...
4
votes
2answers
391 views

What is the purpose of a Pepper?

I've been trying to find out exactly what a pepper is. The only things I could accurately determine are that a Pepper: Is theoretically unique from site to site and hard-coded in the site's source ...
10
votes
6answers
1k views

Do salts have to be random, or just unique and unknown?

First of all, my motive is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database. After discussion in comments and in ...
3
votes
5answers
267 views

Are hash functions “strongest link”?

It seems to me that if you were to use multiple hash functions, the "strongest link" would hold up the others. For example: HelloWorld --- md5 --> 68e109f0f40ca72a15e05cc22786f8e6 --- sha256 ...
0
votes
2answers
814 views

how to know what hash function have been used

I have a hashed password and the plaintext password and i want to know the exact algorithm that's been used. I have the input and the output of the hash/encription algorithm. How would I know what ...
1
vote
3answers
431 views

Password Security and ocl-Hashcat-plus

I recently read the Ars Technical Article about new features in ocl-Hashcat-plus. In light of questions like: Long Passwords: How are they more secure? and XKCD #936: Short complex password, or ...
2
votes
1answer
1k views

Which part of the eapol packets contain WPA password Hash?

I have captured wifi traffic from a WPA network using Wireshark. I filtered the results for "eapol" packets and noted in the info column there are message type 3 and type 1. I believe this is two ...
22
votes
8answers
2k views

Why is password hashing considered so important?

After reading this article, I can see the benefits of password hashing as a second layer of defence, in the event of an intruder gaining access to a password database. What I still don't understand is ...
0
votes
3answers
143 views

Devising encryption schemes and protocols

I am wondering how encryption schemes are developed and why certain decisions are made. For example. I have seen a company hash a string with SHA1 and then RSA encrypt it. Why? I've also seen the ...
2
votes
4answers
199 views

Why do some passwords not allow certain types of characters?

Is there any programing related reason why some password cannot have certain characters? If the idea in storing a password is to store it's hash, since a hashing function can take any input (ok at ...
1
vote
1answer
121 views

Is double hashing bad? [duplicate]

I hear rumors that double hashing is bad... like hash("sha512", hash("whirlpool", "string")) Is it bad and less secure? if so why? Thanks for any help!
6
votes
2answers
330 views

Salt placement prior to one-way hash

In one-way hashing its common to prepend or append the salt to the secret and then hash it: (salt + secret) or (secret + salt). I was thinking of this metaphor as salt falling on a plate of food. It ...
0
votes
3answers
191 views

Need references about why public access to a password hash and salt is poor practice

What are some published industry standards about why revealing the password hash and salt are poor or bad practices from a security perspective? I am dealing with a vulnerability where anyone can ...
2
votes
3answers
201 views

Is there any reason I shouldn't use SHA1 of salt + website name + master password for my password in websites?

I considered writing a program to do the above for websites I only intend to use for short-term use.
-3
votes
3answers
976 views

Generating an unguesable token for confirmation e-mails

I'm generating a token to be used when clicking on the link in a verification e-mail. I plan on using uniqid() but the output will be predictable allowing an attacker to bypass the confirmation ...
2
votes
1answer
187 views

Unknown encryption string [closed]

I'm trying to learn about encryption and decryption methods when I faced this string: {MD5}JfnnlDI7RTiF9RgfG2JNCw== MD5 is 16-byte string, so anyone know what type of encryption is this and why ...
3
votes
2answers
341 views

Is mt_rand() suitable for generating a salt?

Assumed I have to following code in order to generate a random blowfish salt for saving a new password: $blowfishCharacters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./'; $salt ...
16
votes
1answer
291 views

What's this kind of authentication scheme called?

In the past I've heard about a scheme to prove your identity online in places like forums, without having to create an account. When posting, the user would enter a password which is then heavily ...
4
votes
4answers
305 views

User password as key instead of hashing it

I was reading here on Hashes and Salts and I thought about another method to do user authentication. I need your thoughts on this as I might be overlooking something. Scenario: For web application ...
2
votes
1answer
627 views

How to save the random salt to the database

As I understand it, salting and hashing passwords is the way to go. I also understand that to authenticate a salted and hashed password, the random salt needs to be saved. Does this mean that if I use ...
8
votes
3answers
794 views

Is this code snippet good enough for password hash and salt

After a few days reading up about salting and hashing passwords, I found an actual bit of code that tells how to do it. This is what I found: $blowfish_salt = ...
5
votes
4answers
2k views

SHA-512 unix passwords. How secure are those hashes, really?

I came across this very alarming sounding thread which indicates a GPU with about half the compute capacity of the GPU currently powering the monitor I type this on is capable of 11.5k c/s. I'm not ...
4
votes
2answers
636 views

Rounds of MD5 and SHA512 Hashing Algorithms

What is the exact number of rounds employed by the MD5 and SHA512 hashing algorithms? According to various sources, the SHA512 hashing algorithm employs a total of 80 rounds ...
5
votes
2answers
125 views

What is the meaning of the term “simple string” for the SALT string in Unix crypt using SHA-256 and SHA-512?

In Unix crypt using SHA-256 and SHA-512 the author, Ulrich Drepper, introduces the SALT string as the following (highlight by me): For the SHA-based methods the SALT string can be a simple string ...
5
votes
5answers
832 views

Is it a good idea to use an input by the user as SALT?

I have read many Q&As here on IT Security about password hashing and salting. I am building a simple registration form for our community website which will be used by our members to create their ...
1
vote
1answer
144 views

Generate Keytool Object from CSR

I have to develop an application which uses another application for generating a CSR. After generating the CSR I have to provide this CSR along with a SHA256 hash of the public key to a CA. The ...
0
votes
1answer
216 views

What does it mean by the 'Hash of a malware'?

I have just recently started to delve into the topics of malware. In my hunt for malware binaries, I came across certain responses that it is not easy to grab binaries based on malware names like ...
0
votes
1answer
476 views

How do I generate a blowfish password hash in Ubuntu?

What's the command line to generate a blowfish password hash? I can't seem to figure this out at all. Apache's htpasswd only supports bcrypt, and openssl passwd doesn't even do blowfish hahes (but it ...
5
votes
3answers
1k views

How exactly is MD5 vulnerable to collission attacks?

I've often read that MD5 (among other hashing algorithms) is vulnerable to collisions attacks. I understand the collision part: there exist two (or more) inputs such that MD5 will generate the same ...
-1
votes
2answers
2k views

How to get an NT hash from registry? [closed]

I want to manually get the NT hash from the registry (without any tool). Let's say just for the administrator. I know that it must be stored in the SAM area of the registry somewhere so I tried to ...
2
votes
3answers
650 views

Reversing Password Hashes [duplicate]

if someone got hold of the hashes of all passwords for a website, how do they 1) get passwords from the hashes. As far as I can tell from searching the internet everything seems to say do a dictionary ...
6
votes
1answer
209 views

HKDF and key stretching

I thought that all key derivation functions would do a key stretching phase, by iterating some kind of process. But I can't see that process in HKDF. HKDF doesn't do key strengthening? If I have a ...
2
votes
5answers
191 views

Methods used to reverse a hash

I know that a hash is a one-way-function and that therefore there isn't a reversal function. By reversing a hash I just mean to find some plaintext that gives the hash. I think that I understand that ...
1
vote
2answers
2k views

If hashing is one way, why can we decrypt MD5 hashes?

I have read some times that hashing is a one way function, that is you can make the hash of a message, but you can't recover the original message from the hash, just check its integrity. However, if ...
2
votes
1answer
444 views

What are realistic rates for brute force hashing?

I'm trying to gauge password strength assuming that the attacker has a hash of my password. Can anyone cite some realistic contemporary rates at which someone could perform various hashes? I know most ...
2
votes
3answers
351 views

Storing passwords on a home computer

I remember all the passwords (and variations of passwords) that I use for various sites online. The problem is not that I forget a password, but that I forget which password goes with which site. And ...
3
votes
2answers
104 views

How to ensure two messages are from the same party

I need to verify that two messages, that came over distinct channels, come from the same origin: without knowing anything about the origin beforehand the channels are one-way, only one message may ...
7
votes
2answers
4k views

Safety of publishing last 4 credit card digits in age of fast computing?

How safe is it to make public the last four digits of a credit card? Credit card numbers have a specific format. Digits tell you what type of institution issued the card, what bank issued the card, ...
-1
votes
1answer
188 views

After salting my passwords, are they protected against dictionary attacks? [duplicate]

I use sha1() to hash my users passwords, but recently a friend told me that if someone get the hash then they could use dictionary attack and he recommended using salts. I implemented a random salt ...
2
votes
3answers
396 views

Why are MD5 collisions dangerous?

I understand that the MD5 algorithm isn't collision resistant, and that collisions between data of arbitrary size can be found with more efficient methods than brute-forcing. However, I have read ...
7
votes
3answers
507 views

Does hashing a PRNG make it cryptographically secure?

Would hashing the result of a regular random number generator produce a cryptographically secure PRNG? For example, would sha1(rand()) effectively be a secure PRNG? Assuming it doesn't, how would ...
2
votes
3answers
114 views

User specified iteration count

I'm working on a PHP authentication and registration system following the standard salt+password = 'auth hash' and using the plaintext/unencrypted username as the lookup field on the initial query. ...
5
votes
2answers
287 views

Why is 8ms a goal for hashing?

I'm currently developing a small project in PHP, and as it involves user authentication, I've been researching what options I've got regarding hashing. I've settled on PBKDF2 primarily due to it's ...
3
votes
0answers
242 views

Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]

In my school everyone must change their password every six months. The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...
0
votes
2answers
736 views

Why store the password salt instead of generating it? [duplicate]

So, reading through this article: http://crackstation.net/hashing-security.htm it says that storing the salt is fine in plain text because it renders the lookup/rainbow tables ineffective. I get that, ...
13
votes
7answers
1k views

Why should I hash passwords?

I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it? When a ...
-1
votes
1answer
157 views

Properties for cryptographic hash functions (preimage, second preimage and collision resistant)

While studying computer security at university I have been asked this question: There are three desirable properties for cryptographic hash functions: Preimage resistant, Second preimage resistant, ...
0
votes
0answers
31 views

How can I determine the encryption used by knowing input and result? [duplicate]

Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
-4
votes
2answers
245 views

the Informix password crack

I get some hash like: username sowainformix salt 7307821250330563328 hashed_password HaHvvzanjp_lPZgHLu0KHquN.Q4t98EF48csXk1QTJs hash_type SHA-256 updated flags ...
7
votes
2answers
417 views

Does the md5 (or any hash for that matter) of a string include the null terminator?

Does the md5 (or any hash for that matter) of a string include the null terminator in its calculations? That is does the hash of a string equal the hash of the sequence of bytes that represents the ...