A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

0
votes
1answer
97 views

Breaking encryption with hash value of password?

Can you break an encrypted volume if you know the source code of the crypto-tool used and the hash value of the secret passphrase? Why is it not possible to just reverse engineer the passphrase ...
2
votes
3answers
280 views

Time Memory Trade-Off Attacks

Given, we want to crack a password. With Time Memory Trade-Off Attacks one tries to find the right balance between time to compute hashes for all possible passwords. And the used memory to store all ...
1
vote
1answer
76 views

Is it possible to hash bcrypt passwords more securely?

I'm wondering if it's possible to increase the work factor of an already encrypted bcrypt password. e.g. I have a password that was encrypted with a work factor of 5, is it possible to increase the ...
0
votes
1answer
56 views

Is encryption less resistant to brute-forcing compared to hashing?

I understand that a hashing algorithm like bcrypt uses several rounds of hashing to make it computationally expensive for a brute-force attack. How does encryption work against a brute-force attack? I ...
4
votes
3answers
159 views

Why is password strength often underestimated and uncertain in the context of password hashing?

An aspect of security has bugged me for a long time: Why is there positive certainty about the importance of hashing algorithms and salts, but password strength is either never mentioned at all or ...
1
vote
3answers
995 views

inquiry about SHA1 with RSA for certificate signature

As you all know, plenty of X.509 Certificates use (PKCS#1 SHA1 with RSA encryption) as the Certificate Signature Algorithm for generating the signature of 2048 Bits long. We know that SHA1 hash ...
1
vote
0answers
58 views

How do I determine whether a Linux-based router still has the default password? [duplicate]

My goal is to check if the password used by admin is the default password. I work on a Linux-based router. I know the password is stored as a hashed value in /etc/passwd. In generic Linux machines, ...
0
votes
1answer
382 views

Hash the signing key of an authentication token in database

I have clients which are all browsers. All clients render just a single page application getting data from a Web API. The design of the API follows REST principles. I use token-based authentication ...
-1
votes
1answer
149 views

Is my hashing technique secure? [duplicate]

I am not sure if this is the best place to post this type of question. I have come up with function which, I believe, is a very secure method of hashing. (I could be completely wrong). Here's the ...
0
votes
2answers
135 views

Any reason to use bcrypt, pbkdf2, scrpt for other things than passwords? [closed]

Let's say I want to hash some data, using SHA256, in order to prove I know something. Maybe it's my secret ID for something. In the real of passwords we have moved from hashing -> hashing+salt -> cpu ...
0
votes
1answer
497 views

About password_hash() in PHP and storing (part of) its salt outside DB

So, i learned that new in PHP 5.5 is password-hash() which works much like crypt(). Which is more secure (slower) than md5() or sha1(). The result string is algo+hash+salt, which can be passed as-is ...
5
votes
3answers
509 views

Does checking the fingerprint of a self signed certificate improve security?

I am currently developing a component for an application that does TCP communication with a device inside a local area network. I use TLS to provide data encryption, integration and authorisation. ...
2
votes
1answer
518 views

New to security, is php password_hash() good enough?

This is the first time I've had to handle personnel information and I want to make sure I have a good amount of security. I will be storing users' emails and passwords for their accounts on a MySQL ...
9
votes
1answer
186 views

Securing a prediction about a future event

I want to make a prediction about a future event, but only reveal that prediction after the event occurs lest knowledge of my prediction affect the outcome. For example, suppose Alice predicts that ...
1
vote
2answers
163 views

On what layer should password hashing and/or encryption take place

I'm finding myself on the inexperienced end of a discussion about where password hashing takes place. My coworker drew a schema from less to more secure, where the Public Internet was the least ...
3
votes
1answer
535 views

Best practice for data security on a web application

I read a couple articles on privacy/security but still cannot get a clear picture of the best practice to ensure that an attacker will not be able to access users' private information. For storing ...
2
votes
2answers
131 views

Keyed-hashing a password with a hash of the password + salt as the key, is it safe?

I was looking at our authentication system which hashes passwords differently than I was taught. The salt is a constant byte array and it uses the password + the salt as a key for the password hashing ...
1
vote
1answer
213 views

Is a simple Whirlpool hash with random salt secure enough? [duplicate]

I've been working on a site that requires users to login. It's written in PHP with MySQL, and passwords are stored as Whirlpool hashes with a salt (source code later). However, security sites or ...
3
votes
2answers
156 views

Hashes of overlapping data - does it make them easier to crack even when neither is cracked

Say I have strings: stringA, StringB, stringC. And I make two hashes: HashA = sha256(stringA + stringB) HashB = sha256(stringB + stringC) For the sake of the argument I'm suggesting sha256 but ...
1
vote
2answers
181 views

Hashed Database: Hash Functions

Let's assume there is a database containing names and each name is hashed and the clear-text is deleted. If an attacker were to steal this database, would he/she be able to get the list of names?
0
votes
1answer
147 views

Windows 7 password recovery [duplicate]

A few weeks ago I've changed the password on my old laptop, I forgot the password as I wasn't using it often. Now I need to recover the password because I used it to encrypt some important documents. ...
0
votes
2answers
99 views

Password stretching using concatenation of hashes

I'm working on a simple file encryption tool. Basically, here's how my program works: password = get_user_typed_password() salt = uuid4() key = bcrypt(password + salt) cipher = AES(key) for block ...
2
votes
2answers
162 views

Does sending two different hashes of the same password reduce security?

I'm updating a login system. The password is sent to the server as SHA512(password + long_string). I want to switch this to something like SHA512(username + password) in the future. By doing that I ...
-1
votes
2answers
174 views

Is AES feasible for secure hashing files? [closed]

There was already a similar topic "Why AES is not used for secure hashing, instead of SHA-x?", but it was not about files specifically, and I, personally, am not convinced by the answers in it. "AES ...
1
vote
1answer
102 views

Sending Salts For Key Generation

I am working on a project that uses a combination of a web based framework (Django) and an installed app (Python) for the purpose of data entry/upload. I will have to send medical records over the web ...
0
votes
3answers
146 views

Hash algorithm without ASIC's

I want to design a new crypto-currency, with an algorithm which is different from SHA-256 or Scrypt. But in order to do this, I need to know the hash algorithm which is the hardest to make ...
1
vote
0answers
63 views

Login details security using salt n hash and a login role in postgresql

I am coding up the security for a website in express.js and postgresql db. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but my ...
1
vote
1answer
68 views

Am I right by changing the default algorithm on a web app?

Numerous clients have told me that my suggestion on changing the algorithm on a web app does not increase security. I've tried reasoning that if the files have not been exposed, the attacker has to ...
0
votes
2answers
579 views

What is the advantage of using a symmetric cipher like AES to generate a keystream?

I see examples of AES (with a shared secret key) being used to encrypt shared secrets (e.g. nonce + counter) to produce a keystream against which the plaintext is XOR'ed to produce the ciphertext. ...
1
vote
2answers
385 views

Should I decode a base64 password before hashing for storage?

My server gets base64 encoded passwords from the client, and I am going to hash them for storage in a credentials table. Should I decode the password and hash the clear text password, or just hash ...
0
votes
1answer
69 views

Using multiple hash-functions along the line [duplicate]

I was wondering what the effect on strength/security is If I would use an aggregate of multiple hash-functions. For instance, I don't want to sent passwords in plain text (although it's over an ...
3
votes
2answers
269 views

How can I store a password history to prevent reuse?

I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt. How can I implement a password history set (to prevent password reuse) in a ...
-3
votes
1answer
90 views

What is this encrypted with or where can I find examples of encryptions to compare it with? [closed]

I have a hash thingy I am trying to decode and I have done relatively little with encryption, though I would like to try to learn some more. The hash is: 1YMTpavsFq7ykllC3CCsg3e1li31re1nROxuW1wqIqpk ...
1
vote
0answers
23 views

How is password character validation in 3D secure is implemented? [duplicate]

We have a website which stores hashed passwords in the database. During logins we hash the password entered by user and compare two hashes. This is quite standard so far. Our client which is in ...
4
votes
2answers
459 views

Is it safe to use PBKDF2 for hashing?

I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
4
votes
1answer
581 views

Is every hash format that nginx accepts for HTTP Basic Auth weak against brute force?

According to http://nginx.org/en/docs/http/ngx_http_auth_basic_module.html nginx can read password hashes of these types: crypt(), apr1, SHA1 & SSHA. This is how I understand how these hashes ...
3
votes
2answers
138 views

Using public key infrastructure or hashing for personal identification privacy?

I've been reading about identity theft recently, and I'm wondering about some possible solutions using the techniques of asymmetric/symmetric/hashing in encryption. My idea is going to cross those 3 ...
3
votes
3answers
419 views

Why not hashing and salting passwords?

When I was implementing my webapp, I decided to hash and salt users' passwords in order to protect them, even though I knew that there will never be a lot of them ... if any. Of course, I'm not saying ...
0
votes
1answer
116 views

Is it a good idea to hash a string and use it as a passphrase?

Is it a good idea to hash(SHA-512/whirlpool) some simple memorable string and use it for passphrase(for LUKS/TrueCrypt container), instead of using just a string like t4k#La93Fs(5w5) as a passphrase?
3
votes
2answers
187 views

Rainbow Tables: What is the Reduction Used for?

This is a follow up from this answer. The answer is very good, and it put me to thinking and doing some research. I have found another good explanation on this site. At some point, the author says: ...
0
votes
1answer
132 views

Rainbowtable - Start with plain text [duplicate]

I know how to use rainbow tables. I've already read the other questions this topic here. Well but there is still one question left. As an attacker, I usually have a hash value of a password and ...
3
votes
1answer
152 views

using counter instead of salt for hashing

I'm developing own protocol for secure message exchanging. Each message contains the following fields: HMAC, time, salt, and message itself. HMAC is computed over all other fields using known secret ...
0
votes
0answers
58 views

Does the ordering of encryption and hashing matter? [duplicate]

I am now learning keyed hash function, where A and B share a secret key k. I want to know if the ordering of encryption E and hashing H matters? i.e. Is there any difference between H ◦ Ek (m) and Ek ...
-1
votes
1answer
105 views

Password sending through network [duplicate]

In case of no TLS/SSL available, why can't I use the hash of the password (SHA512) as the key to encrypt the password (with out any salt) to send through the network ? MITM attacks I can understand, ...
3
votes
4answers
504 views

Irreversible hashing without collision

We are looking to allow users to log on with a smart card. The smart card reader can read the smart card ID and send it to us. We are, however, not allowed to store the smart card ID. Not in ...
4
votes
5answers
564 views

Use the hash of the password to encrypted password

I have a app which transmit the password in clear text. I was planning to use the hash of the password (SHA-512) as the key for encrypting the plain text password. Then send the encrypted text to the ...
7
votes
1answer
468 views

Does bcrypt on top of md5 reduce its security?

A GitHub project I recently checked has a flawed security as they're using an unsalted md5() to hash the passwords. I opened a bug and they acknowledged it. However, the transition from md5() to ...
2
votes
0answers
193 views

How do I convert from this weird John/Asleap format to lc (for HashCat)?

I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
0
votes
2answers
183 views

How secure are hashed passwords that are salted too?

SAP Netweaver has its passwords hashed and also salted. But I read that a tool such as John the Ripper can bruteforce them. So how does security varies when passwords are hashed, in particular in the ...
4
votes
4answers
391 views

usernames and passwords

I was thinking about usernames and passwords and I was wondering how secure it would be to instead of the server having a list of usernames and accompanying hash of the passwords, just have a list of ...