A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
7
votes
1answer
304 views
Identifying an unknown hash
During some of my research work I encountered an unknown hashed string. What I am curious about is the algorithm used to generate it. A factor that makes it interesting - the string contains an ...
9
votes
2answers
580 views
Estimating the size of a rainbow table
What are rainbow tables and how are they used? Gives a very precise answer about what rainbow tables are and how they are used. I had always confused hash-tables and rainbow tables. My question is ...
5
votes
4answers
796 views
Is MD5 considered insecure?
After all these articles circulating online about md5 exploits, I am considering switching to another hash algorithm. As far as I know it's always been the algorithm of choice among numerous DBAs. Is ...
0
votes
0answers
63 views
Recomended hash algorithm [duplicate]
Possible Duplicate:
How to securely hash passwords?
Do any security experts recommend bcrypt for password storage?
What would you choose between:
PBKDF2 SHA256 (270,000 iterations)
...
1
vote
2answers
215 views
Scrypt + Bcrypt = cascade hashing
I've read here that hashing with differents algorithms would be a good idea.
Can you confirm that?
In your experience, is it useful and safe? Does it entail any security holes?
2
votes
1answer
1k views
Is PBKDF2 only SHA1 in C#?
I can't find a way of specifying the hashing algorithm used by the PBKDF2 (the Rfc2898DeriveBytes class) implementation in C# System.Security.Cryptography.
It seems to be just SHA1. Am I missing ...
3
votes
2answers
294 views
Implementing brute force attacks on hash values in Javascript
I'm working for my bachelor thesis at the end of which I aim to implement a proof-of-concept Javascript-based hash cracker. The idea is to work like this: Users can submit a hash value along with ...
16
votes
3answers
5k views
Is SHA1 better than md5 only because it generates a hash of 160 bits?
It is well known that SHA1 is recommended more than md5 for hashing since md5 is practically broken as lot of collisions have been found.
With the birthday attack, it is possible to get a collision ...
11
votes
2answers
4k views
Securing a JavaScript Single Page App with RESTful backend
I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
6
votes
2answers
362 views
Production ready bcrypt implementation for .NET
Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments?
I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...
1
vote
5answers
543 views
making an iPhone/Android app which sends a user password to my server, how to secure?
I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login.
I don't have SSL on my website, but it's just a reviews website and ...
3
votes
1answer
87 views
Password hashing on a load balancing setup
I've been doing some research into password hashing implementations and would like to know if it's feasible to have two servers hash passwords to the same database?
I've come across the Bcrypt.net ...
-1
votes
1answer
310 views
Please tell me two strings which have the same MD5 hash value
Yes, I know MD5 is weak and should not be used. To make a prove of concept I need two strings with the same MD5 value but all I can find is binary. Like this nice example. Works fine as binary but ...
14
votes
6answers
742 views
Hash function change
I have user account passwords stored in a database using an unsafe (old) cryptographic hash function.
What is the best/usual approach to changing password hash function? Only two ideas come to my ...
1
vote
1answer
238 views
What kind of hashing is generally used in log-in modules?
Do operating systems hash the log-in password?
What hash function is used in Windows XP, 7, 8,Linux Ubuntu, Debian, MAC Lion OS X ,...?
Where should I look to know these security considerations of an ...
5
votes
3answers
243 views
How can Microsoft validate a shorter password on Microsoft accounts (MSDN)?
I recently ran across this when logging into MSDN. (I saw this screen after typing my initial credentials.)
I have a 20+ digit password, however there's apparently a new requirement for Microsoft ...
6
votes
3answers
307 views
How secure is HTTPS with weak ciphersuites?
Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
-1
votes
2answers
109 views
Should I use salt to authenticate data?
I have a client and a server. The client makes a request containing userId, cardId, position (on the card)
A hacker could just do the same http request with the next position. So I think about ...
3
votes
2answers
116 views
What steps can you take to make offline cracking of SRP harder?
In the aftermath of the Blizzard hack, what steps can I take to make offline cracking of SRP more difficult?
My question assumes that your database is already gone and that you implemented SRP more ...
2
votes
7answers
470 views
Tracking unique web site visits without logging IP addresses
On Monday, some IP address xxx.xxx.xxx.xxx visits my site. I log it.
On Tuesday, another IP address yyy.yyy.yyy.yyy visits my site. I log it.
If the two IP addresses are equal, I throw out the ...
1
vote
3answers
171 views
For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?
I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
10
votes
4answers
891 views
How secure is the SRP that Blizzard uses to protect passwords?
Blizzard very recently announced that their network was compromised, but they assure users in their statement that the password information that the attackers had access to was saved in a secure way:
...
5
votes
8answers
675 views
Does truncating the cryptographic hash make it impossible to crack?
I store password hashes in their full value for example, $h = sha256('foo') outputs 64 characters: 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae
I store that directly in the ...
2
votes
6answers
191 views
Is it okay to wrap a cryptographic hash with MD5 for storage?
Is there any security issues if you wrap your cryptographic hash with MD5 for storage purposes?
For example:
$hash = md5(hash($password,$salt,$rounds));
Note: hash() uses scrypt or bcrypt or pbkdf2 ...
5
votes
4answers
453 views
Is sha-1 hash always the same?
Is it possible to ensure that a string is hashed always the same way no matter which language you use to do it (Java, vb.net... ) and no matter what operative system you are?
-1
votes
1answer
184 views
Global salt vs salt-per-password [duplicate]
Possible Duplicate:
Password Hashing add salt + pepper or is salt enough?
Any risk in using the same salt for several hashes on a user?
It's known that all password hashes need to be ...
0
votes
1answer
501 views
How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry? [closed]
The problem I want to avoid is "brute force" attacks against a database. So if I add a 50-byte-long cryptographically random salt to my information (which I don't need to retrieve, just its hash) - is ...
3
votes
1answer
153 views
How should I store a password to allow people to enter single characters from it? [duplicate]
Possible Duplicate:
How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?
Some banking applications ask for random letters ...
1
vote
2answers
489 views
Is there an index of all md5 collisions?
I am about to build a caching system based on md5 to generate file names out of lists of natural numbers. The inputs would be groups like: 1,18,94,100,266,1854.
I know there are some collisions in ...
7
votes
2answers
385 views
Is there more to password hashing?
You have a plain text password and salt. The plain text password is assumed to be securely random and only known by the user and the salt is no secret and not necessarily unique but stored alongside ...
6
votes
2answers
718 views
With PBKDF2, what is an optimal Hash size in bytes? What about the size of the salt?
When creating a hash with PBKDF2, it allows the developer to choose the size of the hash. Is longer always better? Also, what about the size of the random salt? Should that be the same size as the ...
1
vote
1answer
71 views
How to verify that a clientside-generated object is genuine?
I know that general best-practice states not to trust anything generated by the client.
With that in mind, I want to write an HTML5 app that utilises the browser to generate various objects ...
41
votes
5answers
5k views
Is sending password to user email secure?
How secure is sending passwords through email to a user, since email isn't secured by HTTPS.
What is the best way to secure it? Should i use encryption?
5
votes
2answers
139 views
Can a HSM be used to make password hashing stronger?
Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
-2
votes
2answers
200 views
How to secure passwords when site is opensource [duplicate]
Possible Duplicate:
How to securely hash passwords?
How can I store passwords to have them secure? Right now the site use md5 md5, I was thinking about sha1+salt but if the source code for ...
5
votes
3answers
255 views
How can we factor Moore's law into password cracking estimates?
How would we go about factoring Moore's law into exceedingly long password cracking estimates?
Let's say we've got a 12 character password containing mixed-case alpha characters and numbers, i.e. ...
1
vote
3answers
3k views
Windows 7 Password Hash Security
I recently came across a number of sources that suggest that cracking Windows user account passwords is easy by examining their password hashes.
I understand that these hashes are stored in the SAM ...
4
votes
3answers
359 views
Trying to understand password hashing
I am trying to get a grasp of password hashing. Back in the days it seemed so simple, just MD5(password + salt) and you are done. Then md5 was proven to have collisions so people started moving to ...
2
votes
3answers
100 views
Clarification on an email about a security breach
I got the following email from a forum I was subscribed to:
It is our duty to inform you that there has been a security breach on
the server that Doom10 was being hosted on. It doesn't seem like ...
4
votes
3answers
2k views
How to crack password hashed using SSHA?
Is it possible to crack a password hashed using SSHA if I know the salt? How can I do it?
10
votes
3answers
456 views
Does the salt need to be unique or not predictable?
I always thought that salts is simply used to prevent rainbow tables to be used. Other have suggest they should be unique on a per account basis. Currently i have been using a config file to use as ...
15
votes
7answers
383 views
To salt, or not to salt? [duplicate]
Possible Duplicate:
Why is using salt more secure?
Why would salt not have prevented LinkedIn passwords from getting cracked?
Recently I decided that I wanted to learn more about web ...
1
vote
4answers
294 views
How password hashing is useful in MITM attack?
Even though I read a lot about hashing and how passwords are protected, I am still confused about it.
If passwords are hashed at client side, it will be useless because it can be sniffed and used by ...
121
votes
7answers
8k views
How to store salt?
Nowadays, if we expect to store user password securely, we need at least do the following thing
$pwd=hash(hash($password) + salt)
then store $pwd in your system instead of the real password. I have ...
2
votes
1answer
180 views
PCI-DSS and salt storage
PCI-DSS states the following:
3.5 Protect any keys used to secure cardholder data against disclosure and misuse
I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...
4
votes
5answers
273 views
Can hash functions be used with CTR or OFB mode?
I have been writing a class that encrypts and decrypts with block ciphers. I want to use Counter Mode(CTR/CM). We know that Counter Mode generates a keystream basing on counters, then XOR the ...
-2
votes
1answer
195 views
What encryption hash function I should use for password securing? [duplicate]
Possible Duplicate:
How to securely hash passwords?
What is the best encryption algorithm? MD5, SHA1, SHA2 or maybe something else? Can you explain me why?
5
votes
4answers
248 views
How to upgrade the hashing method of a live database without compromising security?
I'm working on an Intranet project that is accessible from the outside. The password are stored in a Sql Server database in the normal Hash and salt method. The problem lies in the hashing algorithm.
...
1
vote
3answers
159 views
Does this kind of hashing exist?
Let's say you have two user defined strings, X, Y and you want to hash them into the hash Z. That is what most websites would do, X is the user's password and Y is the salt. It takes a lot of time to ...
1
vote
3answers
273 views
Differences between brute forcing access versus decrypting password files or databases
I was just reading about how it's better to use bcrypt to protect passwords instead of saving password hashes in databases, and that got me thinking about other aspects that hackers work on that I had ...
