A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

1
vote
2answers
134 views

Is bruteforcing the last character of a salt a good idea?

Would it be a good idea security-wise to store salts with their last character removed, and then bruteforce the last character to further the amount of time it would take to create rainbow tables and ...
0
votes
1answer
137 views

Could overlapping SHA256 hash begin to loop at some point?

I have a system that needs to send a key to the user. This key is used for validation after work and needs to be shown that we do not change it mid-work so we send to the user in the middle of work a ...
4
votes
1answer
996 views

How can I extract the hash inside an encrypted PDF file?

As long as I know, the encrypted PDF files don't store the decryption password within them, but a hash asociated to this password. When auditing security, a good attemp to break PDF files passwords ...
1
vote
1answer
34 views

Should I verify installer file PGP hash?

Let's say that I'll download an installer for a program on Windows and the publisher has released PGP Signature for the file. The installer file does not have any code signing certificates. If I ...
2
votes
1answer
108 views

Is it fine to store single-use beta keys plain-text?

Is it okay to store single-use beta keys in plain-text in the database? I'll be pre-generating and storing about 2M keys. The keys get passed around so that people can sign up with it, rather than let ...
5
votes
2answers
257 views

How is a hash's algorithm detected based on the hash?

I was reading an Ars Technica article this morning and came across the following towards the end (emphasis mine): Equation Group included six other hashes in different exploits that remain unknown ...
4
votes
1answer
65 views

Why there is a signed hash in Certificate request (.csr file)?

I wonder why there is a hash signed by private key in the CSR? It does prove that I have the private key that belongs to the public key in the .csr. But who cares whether I actually do possess the ...
2
votes
2answers
78 views

Virus - by-pass with binairies repackaging

Why don’t « hackers » (or more accurately, « virus maker ») just do repackaging over their malware to by-pass antivirus software? Because it resolves the issue of the virus signature (kind of hash), ...
0
votes
3answers
109 views

It is possible detecting threat by only with file information?

It is possible detecting threat by only with file information of a file like file's hash(md5,sha1,sha256, etc), file size, mime type, etc with ClamAV or Comodo AV for linux with shell command? It ...
2
votes
1answer
144 views

Truncating hash output for a unique ID

This seems like a common question, but my knowledge on hashing is very limited, so I'm looking for a more ELI5-type answer. I would appreciate if someone could help me with my questions Some ...
1
vote
1answer
125 views

Given Hash digest, calculating any random input

I understand that for a hash function there are an infinite amount of possible inputs that could produce a specific output. So if you're trying to find a specific input that created an output that ...
1
vote
1answer
98 views

Cracking office documents and other hashes using clusters? [closed]

I'm trying to figure out how I should go about testing this I just got donated 18 older hp systems that have 4 gigs of ram, and intel core 2 duo processors I believe that they are the ones that came ...
2
votes
2answers
105 views

Hashing a password, and summing it with every byte in a file. How secure?

I have a text document with all my usernames and passwords in it sitting on my desktop. I decided to spend a couple hours making that more secure. I wrote a program for the purpose. It takes a ...
2
votes
2answers
143 views

Randomness of hash token in password reset link [duplicate]

I want to know what are the points to be kept in mind while creating a hash token for my password reset links. In particular, how to make it un-predictable for an attacker?
14
votes
6answers
3k views

What are the differences between an encryption seed and salt?

Today I had a hard time explaining the difference to a friend. I know seeds are used when generating "random" strings. And salts are used when providing different outcomes to a hash. What is a ...
1
vote
2answers
121 views

Is there any benefit to hashing sortcodes + account numbers?

We have a database of sort codes (6 digit numbers) and account numbers (8 digit numbers) that we use to reconcile monthly accounts with the table of supporters. There is nothing in the data received ...
2
votes
1answer
98 views

HMACs that have the same key and message

im using HMACSHA256 to generate the hash of password and store it. the objective here is to just authenticate users, i.e - save their hashed passwords, and validate users whenever needed using the ...
3
votes
1answer
169 views

How does Dropbox actually protect against sharing copyrighted content?

This TechCrunch article discusses how Dropbox uses hashing to check whether you're sharing copyrighted material "without actually looking at your stuff." Specifically, they offer the following ...
1
vote
1answer
74 views

Digital signatures and weak hash functions

There was this question in last year's exam. The teacher claims that answer b) (in boldface below) is correct. Attacks are constantly being performed on digital signatures which use weak hash ...
1
vote
3answers
105 views

How to compare passwords with duplicate password

On Steam, the gaming client, I have this habit of creating multiple "smurf" accounts. I have a randomly-generated, unique password, and I decided to use the same password for all of my multiple ...
2
votes
1answer
310 views

RESTful web application security and authentication scheme

I am building a web application where the front-end is a single-page-app and the back-end serves it through a RESTful API. I want to make sure I implement user authentication with the best security ...
2
votes
1answer
235 views

Crackstation “Secure Salted Password” Java example - is it really secure?

I'm making an auth service so I've been looking for some good Java/Groovy implementations of password + salt hashing. I've found this article on crackstation along with a code example and decided to ...
12
votes
5answers
2k views

What is the best way to transmit password hash over unreliable TLS?

I have TLS connection between my server and client. I have no certificate, so the connection is susceptible to the Man-in-the-middle attack. I fear that attacker could intercept the password hash ...
0
votes
2answers
586 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
1
vote
1answer
180 views

TLS 1.2 Handshake: How is the ECDHE public key signed by server?

I am dealing with a situation where a cipher option, such as ECDHE-ECDSA-AES128-SHA, is chosen for establishing a TLS connection. In this case, a server, when sending the ServerKeyExchange message to ...
4
votes
3answers
170 views

How can I create a unique identifier that can not easily be reversed?

I've been working on the design of a longitudinal study and one requirement is: all participants will have a unique identifier that is not reversible from the data storage/analyst side of the study ...
1
vote
3answers
161 views

How to transform an hash into a usable password?

I was reading about PwdHash and it inspired me to create a little project where you input a master password and an easy to remember alias into a password hash, like bcrypt, and then you get an hash. ...
0
votes
2answers
60 views

Is authenticating via the database secure

Sorry for this probably noobish question. So far, I've read password comparison/verification is implicitly understood to be made on the application layer and not in the database. For example in PHP, ...
8
votes
5answers
4k views

How is hashing safe if a given string always generates the same hash? [duplicate]

I am a newbie to hashing, and I understand that MD5 (I know it's broken) and SHA-1 are all fixed hashing algorithms, but given that most passwords are dictionary words or other similar passwords, ...
0
votes
1answer
140 views

TrueCrypts full Disk Encryption still secure? [duplicate]

I'm wondering because it only uses RIMPEMD-160 with just 3000 iterations. Isn't that somewhat low and weak? Even though I saw the NSA document that the NSA were not able to break TrueCrypt in 2012.
4
votes
1answer
340 views

Brute Forcing LUKS Full Disk Encryption - Time?

let's say we have encrypted our drive with AES 256 XTS and the following Hash: SHA1 with ~500k Iterations and a 20+ password SHA512 with ~250k Iterations and the same 20+ password. Let's think of ...
1
vote
2answers
126 views

About SHA1 in default Disk Encryption in Linux

Link to the Thread: Recommended options for LUKS (cryptsetup) I wonder what's the exact difference between SHA1 and SHA512. I know that SHA512 has a longer key but I've read that it doesn't matter ...
3
votes
5answers
388 views

Are all unsalted password hashes inherently insecure?

Maybe I'm missing something obvious... Are all passwords stored in common, unsalted hash algorithms able to be attacked via rainbow tables?
2
votes
1answer
231 views

PBKDF2 strong salt for client-side hashing

What should I use as a secure/strong salt for PBKDF2 hashing when salt is not available to use before login as it will be client-side javascript to hash user+pass with PBKDF2 ? I'm going to use ...
1
vote
1answer
77 views

PBKDF2 strong salt

I want to use a strong authentication scheme, so I decided to use PBKDF2. I'm using PBKDF2 with SHA256 algorithm, 5000 iterations and I use username (which is full email address of user) as salt. So ...
0
votes
3answers
249 views

Testing a password for similarity to previous hashes

This question is a follow-up to a comment by Tobias Kienzler to an answer to "What is the purpose of the “Password minimum age” setting?". Consider a password policy that new passwords cannot be ...
7
votes
1answer
304 views

Any problems with scrypt yet?

In the question Do any security experts recommend bcrypt for password storage? Thomas Pornin recommends the hashing function scrypt but saying it is "too new to be recommended on a general basis". ...
3
votes
3answers
289 views

Are credit card number look ups more secure with a hash function than with a deterministic encryption algorithm?

I understand PCI DSS 3.0 allows hashes of cardnumbers to be stored separately from encrypted values, but I'm startled at the efficiency of tools like hashcat in discovering card numbers from hashed ...
5
votes
2answers
142 views

which memory hard hashing algorithm can equalize low-computational and high-computational power devices to utilize blockchain in the IoT?

Recently IBM and Microsoft showed their interest (IBM post, Microsoft post) in utilizing bitcoin's blockchain for internet of things (IoT) development. Let's assume that in close future the blockchain ...
1
vote
1answer
73 views

Storing salt and hashed password [duplicate]

Is there a benefit to storing salt appended to hashed password in a single column of a table verses storing salt and hashed password in different columns of the table. The OWASP guide here ...
0
votes
0answers
73 views

How much risk is introduced by git's signing the commit hash rather than the blobs? [duplicate]

Since first switching from centralized VCS systems to a decentralized one—specifically git—I have properly understood that that git's commit ID's were hashes of the included objects and some meta data ...
0
votes
1answer
141 views

How to secure sensitive data in application with message queue

Currently we are creating one small service, where we are using some sensitive data from users(not worth zillions but to me it is like password). The idea is that application itself only inserts this ...
-3
votes
2answers
63 views

Can I prevent brute forcing of hashed+salted user passwords without a dedicated validation server? [duplicate]

Salted hashes don't seem to offer any real protection for user passwords by itself. So long as a hacker has a quick way to check if a password is right or wrong, it's trivial to brute force it to view ...
1
vote
2answers
59 views

One-way function for data synchronisation

I have to synchronise small sets of data between two or more systems over an insecure network. First I have to check that the other system has the same unique identification information for the data ...
11
votes
2answers
1k views

How can I find out the password hashing schemes used by the specific Unix accounts I log in to?

Every day I ssh in to 3 or 4 independent Unix accounts. I have been regarding them as more or less "equivalently secure" on the grounds that I'm using ssh, but after learning of how much variety ...
0
votes
2answers
77 views

Is it safe to use a derivative of a password as a salt

I know for a fact that salts are an important part of storing a password securely in a database. Most people store the password hash, and the salt that was used for it. This, I have learned, isn't ...
0
votes
3answers
1k views

Which PHP encryption method is most incidentally-secure?

just started researching on the latest PHP encryption methods, I've found out my favorite algorithms are compromised. MD5 is no good, SHA-1 has "found flaws", SHA-512 isn't "meant for passwords", ...
3
votes
2answers
151 views

John the Ripper not identifying a password contained in the username?

I have uploaded a screenshot of what exactly is going on, here: http://i.imgur.com/bJSv7C8.png I can see that single-crack mode includes a rule that looks at the username, and "slices" it to identify ...
0
votes
1answer
436 views

Good password hashing algorithm compatible with PHP and Linux apps

I'm looking for a password hash method for a new server system. The hashes must be generated from PHP code and verified from PHP as well as by a number of applications on a Linux system. I know that ...
0
votes
0answers
23 views

Is it possible to pass the hash with a hash captured from spoofing NBNS responses?

I know that it is possible to use a hash obtained from the Windows SAM in a pass the hash attack, simply setting the hash for the SMBPass paramter for various modules in metasploit. Can a hash ...