A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

3
votes
2answers
244 views

Is it unsafe to have hashes of parts of a private string

We have string B and the hashes hash(P+B), hash(P); is it possible for P to be revealed easier using this information than having hash(P) ? What is the difference ? Any links to articles or any ...
-2
votes
3answers
232 views

My friend hashes passwords with SHA512 algorithm without salt. How do I convince him that he needs to add salt?

Today I discovered something incredibly stupid - my friend hashes user passwords with sha512 algorithm without a salt. I immediately raised this issue to him but he said he wants to see anyone crack a ...
2
votes
2answers
129 views

Difference between Second Pre-image Resistance and Collision Resistance in Cryptographic Hash Functions

I am studying the subject from these notes. However it is not clear what is the difference between "Second Pre-image Resistance" and "Collision Resistance" properties of Cryptographic Hash Functions. ...
2
votes
1answer
78 views

Security of shared “super pin” code table at meineschufa.de

The german brank credit report service "Schufa" uses a so called "SuperPIN" to enable users to reset their password. This super pin is a permutation of 30 lower and upper case letters and digits and ...
28
votes
5answers
11k views

Why AES is not used for secure hashing, instead of SHA-x?

As far as I understand, AES is believed to be extremely secure. (I have read somewhere that it would certainly not be broken in the next 20 years, but I am still not sure if the author was serious.) ...
1
vote
0answers
100 views

Breaking it gently

Let's say I've found a fundamental error with mathematics of a security package. For example, let's say I've found something similar to the Pollard’s \rho-1 algorithm that renders some of the RSA keys ...
3
votes
1answer
165 views

Windows system password hashed - see which hash is used

How can I know / see if my windows is using NTML, LM, NTML2 for its user account passwords? What is the standard today, in windows systems?
14
votes
5answers
4k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
14
votes
3answers
2k views

Content hashes to help protect resources being fetched from a CDN

During a conversation in The DMZ, it was suggested that an SHA256 hash could be used to check that content being delivered from a CDN hasn't changed before being executed, similar to how Kim Dotcom's ...
1
vote
1answer
85 views

Can a known MD5 hash limit the search space for SHA1 collisions?

For a course in game theory, we are dealing with BitTorrent and alternative strategies (roughly alternative clients) we can employ to maximize our download speed. One strategy is to over-report the ...
3
votes
3answers
526 views

Accepting other similar passwords when storing a salted, hashed password

If a website stores passwords as a salted hash, is it reasonable to accept similar passwords as correct? For example, given the password stackexchange, does it dramatically decrease security if the ...
7
votes
2answers
625 views

Does Outlook store plain-text passwords?

A long time ago when Microsoft changed my e-Mail from Hotmail to Outlook the password-interface said that I should only put in the first 16 chars of my password. But my password was longer before. So ...
0
votes
1answer
136 views

How to decode/decrypt strings of text [closed]

So I'm trying to decrypt/decode some text strings. I don't believe they're hashes because they vary in length too much and the software they are used for is able to easily decode them and display them ...
1
vote
1answer
139 views

Adding hash value to user supplied URL in a web application: any security benefit?

We administer a Java web application from an external supplier where we have access to the source code. The user is able to provide an external URL which is stored in a database and later on embedded ...
0
votes
3answers
151 views

Is is necessary to encrypt the message digest?

In symmetric key settings, in order to provide the message integrity, we compute the hash of the message. The message along with the message digest is then encrypted. Is it necessary to encrypt the ...
13
votes
2answers
589 views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
0
votes
1answer
2k views

How do I hash a password in C#? [duplicate]

I assume that the best way to handle passwords for a website is I create a hash of the password and save that hash in my database. Then when someone tries to login, I do a hash of the password they ...
25
votes
6answers
24k views

Most secure password hash algorithm(s)?

What is/are currently the most cryptographically secure hashing algorithm(s)? (available in PHP) Speed is irrelevant, because I'm iterating the hash over a fixed time (rather than a fixed number of ...
7
votes
4answers
2k views

Gold Standard for password hashing

I've developing a web application that will be dealing with highly sensitive information and I want to ensure the hashing of passwords is gold standard. Ideally I'd go for per-user salted SHA512 ...
1
vote
2answers
151 views

Search on hashed data

We have a request to encrypt customer personal data (e-mail, address etc.) We use MySQL which does not have any TDE like MS SQL or Oracle. So along with encrypting data we need to preserve ...
0
votes
3answers
6k views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
2
votes
3answers
158 views

Is it ever safe to publish hashed data?

I'm having a friendly debate with someone who thinks that a website can safely make public sensitive data about it's users as long as that data is hashed (don't ask why, it's a long and hypothetical ...
0
votes
2answers
59 views

Protect against malicious client with key derivation function (PBKDF2)?

Consider a protocol that allows clients to retrieve XML "forms" from a server. Forms are identified by a unique, randomly generated form ID that is embedded in the form. Clients fill out the form and ...
3
votes
2answers
286 views

How safe is to secure sensitive content by URL with MD5 hash and no other authorization?

Suppose we have website that use MD5 hash in URL like this: http://somewebsite.com/XXX/ where XXX is MD5 hash. Content of this website may have sensitive information like transaction details with ...
0
votes
1answer
83 views

Secure log in without sending plain test to server

I know this question asked so many times, but here I am again with it. I am working on an application in which I need to log-in users but the question is it is not a good Idea to send user credentials ...
4
votes
2answers
238 views

Is there a strong reason to salt and hash passwords when password reuse is not an issue?

I am dealing with a system (in development) that uses randomly generated (not user provided), unique, strings to authenticate services that will consuming an API. Right now, these strings are stored ...
7
votes
4answers
1k views

Why secure encrypted data consistency by strong hashing?

Consider the SSH protocol: the SSH packet is like [data, SHA1(data)]. The packet is entirely encrypted by a block cipher. The question is, why do we need a strong hash to protect the packet ...
13
votes
3answers
1k views

Trying to understand why signatures in root certs “are not used”?

Taken from here: Don't worry if the root certificate uses SHA1; signatures on roots are not used (and Chrome won't warn about them. Why are the signatures not used? Are not root certificates ...
0
votes
2answers
68 views

Is my Password Hashing Secure or not?

I have recently created a code for hashing password. Can you please give your advice over the security of my code? The function takes a password, then converts it to a number. #include <string> ...
0
votes
1answer
172 views

Idea for an algorithm to authenticate users with zero-knowledge-proof [need thoughts/review]

I have an idea for an algorithm. I don't know if I made any mistakes and need some extra thoughts/peer review on it. This would work as an (almost)zero knowledge proof for sending passwords that can ...
4
votes
1answer
159 views

Using random number to salt passwords

in a project I have, I'm salting passwords with 3 salts at the moment... Static salt - hard-coded into the source-code. Randomly generated salt (using a function designed for generating password ...
0
votes
2answers
100 views

Authenticate User Salted Hash Without Username

I've got a page with a login system where you type your username and password, the salted hash gets pulled down from the database depending on the username ... SELECT hash FROM db WHERE username = ? ...
-2
votes
1answer
240 views

What hash version is implemented on ThePirateBay.se? SHA-1 or MDA-5? [closed]

I downloaded a File Checksum Utility executable file from Microsoft. This tool is for checking the hash of a file. I'm wondering what is the version of the "Info Hash" section on the torrent site ...
-2
votes
1answer
97 views

client side and server side hash password [duplicate]

Another question about client or server side password hashing, I know. After reading many other post about this topic I'm still a little confused and not completely sure what is the best, because I ...
3
votes
2answers
387 views

Why is a CSR hashed?

What are the use cases for defining something other than the default SHA1 hash in a CSR? Is it to protect the digital signature, public/private keys? What is it protecting exactly?
6
votes
1answer
572 views

What is “c/s” in context of hash cracking?

I was reading hashcat's About page, and the stats are listed in terms of c/s....is that "Cracks per seconds"....the 'c' part seems wrong, I'm just guessing. What is 'c'?
0
votes
1answer
69 views

Good way to make a secure token for logged out users

I work for a firm that has a marketplace on the web. We want to make a link with a token that stops an ad on the marketplace without the user being logged in. Someone suggested that we make a token ...
0
votes
1answer
182 views

encrypted lookup-keys for key-value store

I'd like to use a key-value store (cassandra, redis, ...), but I don't trust the server. The clients have a shared secret, and I'm using that to encrypt the stored values. But what is the proper way ...
2
votes
4answers
582 views

Is hashing the hash considered an extra level of security [duplicate]

As in md5(md5(md5(x)))... I can remember coming across that in some piece of code. If the attacker can somehow reverse md5(md5(md5(x))) into md5(md5(x)) then he certainly can reverse md5(md5(x)) into ...
0
votes
2answers
129 views

Do hashes repeat themselves?

I am not sure how hashing works exactly, all I know it is impossible to reverse it. All hash types have X amount of characters in them while the phrases and made up words can have an infinite quantity ...
0
votes
2answers
228 views

Is this hash function safe?

Below is the hash function implementation of the roguewave library. It returns a 32 bit hash. The core operation is A = B ^ ((C << 5) | (C >> 27)). Is this hash safe to use as a password check ...
1
vote
4answers
434 views

Should BCRYPT be used for client-side password hashing

I am concerned about the use of bcrypt for client-side password generation. I am developing a password generation function to be used client-side, similar to PwdHash and PasswordMaker. Much has been ...
-2
votes
1answer
466 views

What type of hash is that [closed]

Hey do you guys know the algorithm used to generate this hash? 6874747a3b202063733437373676342f766c2f6e6520753933313538343931206175646960732039‌​353861383a3a36663836392f6e7a3325313638 It's ...
3
votes
1answer
363 views

How to check for presence of LM hashes in local SAM

To get rid of LM hashes in local SAM databases, one can rely on the famous NoLMHash domain GPO, which instructs clients not to store password hashes with the LM algorithm locally ("Do not store LAN ...
2
votes
3answers
275 views

Does figuring out what one password hashes to allow you to crack all identical passwords?

Forgive me, as I am very new to cryptography, but it seems interesting, and I have a question. I'll state my beliefs and please feel free to correct me on the aspects that I'm mistaken so i can ...
0
votes
1answer
192 views

What multiplier to use when calculating the average time to crack passwords with a given entropy?

Suppose that we have a process that generates passwords with entropy E. I'd like to compute the average time it would take for a brute-force attack to crack an MD5-hashed instance of such a password. ...
-1
votes
1answer
81 views

Can HMAC leak the password? [duplicate]

Imaging the following pseudo-code: h = hash(sha512) h.input(password) h.input(message) send h, message to client If the user has the hash and the message, and the only missing variable is the ...
18
votes
4answers
2k views

Should I use own constants when using well known hashing algorithms?

I understand that it is important to use well known and well tested hashing algorithms instead of designing my own. For such there often are reference implementations available, which initialize the ...
2
votes
1answer
175 views

Is encrypting something more than once safer than hashing more than once?

I am aware of the implications that hashing something more than once correctly will increase the security of a system, but doing it incorrectly will decrease it, as noted here and on various other ...
2
votes
4answers
733 views

Using last characters of hash as salt [duplicate]

In a recent discussion somebody mentioned the following hashing scheme: passHash = sha256(password) saltedHash = sha256(passHash+passHash.substr(-10) finalHash = sha256(secret+saltedHash) The ...