A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

1
vote
2answers
161 views

On what layer should password hashing and/or encryption take place

I'm finding myself on the inexperienced end of a discussion about where password hashing takes place. My coworker drew a schema from less to more secure, where the Public Internet was the least ...
3
votes
1answer
534 views

Best practice for data security on a web application

I read a couple articles on privacy/security but still cannot get a clear picture of the best practice to ensure that an attacker will not be able to access users' private information. For storing ...
2
votes
2answers
130 views

Keyed-hashing a password with a hash of the password + salt as the key, is it safe?

I was looking at our authentication system which hashes passwords differently than I was taught. The salt is a constant byte array and it uses the password + the salt as a key for the password hashing ...
1
vote
1answer
212 views

Is a simple Whirlpool hash with random salt secure enough? [duplicate]

I've been working on a site that requires users to login. It's written in PHP with MySQL, and passwords are stored as Whirlpool hashes with a salt (source code later). However, security sites or ...
1
vote
2answers
383 views

Should I decode a base64 password before hashing for storage?

My server gets base64 encoded passwords from the client, and I am going to hash them for storage in a credentials table. Should I decode the password and hash the clear text password, or just hash ...
1
vote
2answers
181 views

Hashed Database: Hash Functions

Let's assume there is a database containing names and each name is hashed and the clear-text is deleted. If an attacker were to steal this database, would he/she be able to get the list of names?
1
vote
1answer
1k views

How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry? [closed]

The problem I want to avoid is "brute force" attacks against a database. So if I add a 50-byte-long cryptographically random salt to my information (which I don't need to retrieve, just its hash) - is ...
0
votes
1answer
147 views

Windows 7 password recovery [duplicate]

A few weeks ago I've changed the password on my old laptop, I forgot the password as I wasn't using it often. Now I need to recover the password because I used it to encrypt some important documents. ...
0
votes
2answers
99 views

Password stretching using concatenation of hashes

I'm working on a simple file encryption tool. Basically, here's how my program works: password = get_user_typed_password() salt = uuid4() key = bcrypt(password + salt) cipher = AES(key) for block ...
2
votes
2answers
162 views

Does sending two different hashes of the same password reduce security?

I'm updating a login system. The password is sent to the server as SHA512(password + long_string). I want to switch this to something like SHA512(username + password) in the future. By doing that I ...
-1
votes
2answers
172 views

Is AES feasible for secure hashing files? [closed]

There was already a similar topic "Why AES is not used for secure hashing, instead of SHA-x?", but it was not about files specifically, and I, personally, am not convinced by the answers in it. "AES ...
1
vote
1answer
102 views

Sending Salts For Key Generation

I am working on a project that uses a combination of a web based framework (Django) and an installed app (Python) for the purpose of data entry/upload. I will have to send medical records over the web ...
3
votes
5answers
365 views

PCI-DSS and salt storage

PCI-DSS states the following: 3.5 Protect any keys used to secure cardholder data against disclosure and misuse I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...
0
votes
3answers
146 views

Hash algorithm without ASIC's

I want to design a new crypto-currency, with an algorithm which is different from SHA-256 or Scrypt. But in order to do this, I need to know the hash algorithm which is the hardest to make ...
1
vote
0answers
63 views

Login details security using salt n hash and a login role in postgresql

I am coding up the security for a website in express.js and postgresql db. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but my ...
1
vote
1answer
68 views

Am I right by changing the default algorithm on a web app?

Numerous clients have told me that my suggestion on changing the algorithm on a web app does not increase security. I've tried reasoning that if the files have not been exposed, the attacker has to ...
0
votes
2answers
576 views

What is the advantage of using a symmetric cipher like AES to generate a keystream?

I see examples of AES (with a shared secret key) being used to encrypt shared secrets (e.g. nonce + counter) to produce a keystream against which the plaintext is XOR'ed to produce the ciphertext. ...
0
votes
1answer
68 views

Using multiple hash-functions along the line [duplicate]

I was wondering what the effect on strength/security is If I would use an aggregate of multiple hash-functions. For instance, I don't want to sent passwords in plain text (although it's over an ...
3
votes
2answers
268 views

How can I store a password history to prevent reuse?

I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt. How can I implement a password history set (to prevent password reuse) in a ...
4
votes
2answers
838 views

How does processor architecture affect password hashing speed?

Does hashing speed vary significantly using different architectures (x86 vs ARM)? Scenario I am investigating the possibility of using a cluster of Raspberry Pi for cracking passwords hashed with ...
5
votes
4answers
407 views

Is it a good idea to have a “master” password?

Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
1
vote
0answers
23 views

How is password character validation in 3D secure is implemented? [duplicate]

We have a website which stores hashed passwords in the database. During logins we hash the password entered by user and compare two hashes. This is quite standard so far. Our client which is in ...
-3
votes
1answer
90 views

What is this encrypted with or where can I find examples of encryptions to compare it with? [closed]

I have a hash thingy I am trying to decode and I have done relatively little with encryption, though I would like to try to learn some more. The hash is: 1YMTpavsFq7ykllC3CCsg3e1li31re1nROxuW1wqIqpk ...
61
votes
2answers
10k views

What are rainbow tables and how are they used?

Where can I find one? Is there a pot of gold at the end? How do I protect against them? From the Area51 proposal This question was IT Security Question of the Week. Read the Sep 09, 2011 blog ...
4
votes
2answers
452 views

Is it safe to use PBKDF2 for hashing?

I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
2
votes
1answer
2k views

Which part of the eapol packets contain WPA password Hash?

I have captured wifi traffic from a WPA network using Wireshark. I filtered the results for "eapol" packets and noted in the info column there are message type 3 and type 1. I believe this is two ...
248
votes
10answers
28k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
4
votes
1answer
579 views

Is every hash format that nginx accepts for HTTP Basic Auth weak against brute force?

According to http://nginx.org/en/docs/http/ngx_http_auth_basic_module.html nginx can read password hashes of these types: crypt(), apr1, SHA1 & SSHA. This is how I understand how these hashes ...
7
votes
6answers
792 views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
12
votes
6answers
2k views

Convenient cross-platform help on checking secure hashes like SHA-256

It is often helpful to be able to obtain a good cryptographic checksum of a file, e.g. the SHA-256 hash. This can be used to verify file integrity, so long as you have a reliable source for the hash. ...
3
votes
3answers
418 views

Why not hashing and salting passwords?

When I was implementing my webapp, I decided to hash and salt users' passwords in order to protect them, even though I knew that there will never be a lot of them ... if any. Of course, I'm not saying ...
0
votes
1answer
131 views

Rainbowtable - Start with plain text [duplicate]

I know how to use rainbow tables. I've already read the other questions this topic here. Well but there is still one question left. As an attacker, I usually have a hash value of a password and ...
0
votes
1answer
116 views

Is it a good idea to hash a string and use it as a passphrase?

Is it a good idea to hash(SHA-512/whirlpool) some simple memorable string and use it for passphrase(for LUKS/TrueCrypt container), instead of using just a string like t4k#La93Fs(5w5) as a passphrase?
3
votes
2answers
185 views

Rainbow Tables: What is the Reduction Used for?

This is a follow up from this answer. The answer is very good, and it put me to thinking and doing some research. I have found another good explanation on this site. At some point, the author says: ...
19
votes
10answers
2k views

Can a file contain its md5sum inside it?

Just wondering if it is possible to create a file which has its md5sum inside it along with other contents too.
3
votes
1answer
152 views

using counter instead of salt for hashing

I'm developing own protocol for secure message exchanging. Each message contains the following fields: HMAC, time, salt, and message itself. HMAC is computed over all other fields using known secret ...
8
votes
3answers
917 views

Is this code snippet good enough for password hash and salt

After a few days reading up about salting and hashing passwords, I found an actual bit of code that tells how to do it. This is what I found: $blowfish_salt = ...
1
vote
1answer
2k views

Brute force password cracking with a GPU

How are GPU's provisioned for password cracking? Do all, if not most cracking programs have special GPU aware software or do they just function at the basic driver or API level of the device? Can it ...
0
votes
0answers
58 views

Does the ordering of encryption and hashing matter? [duplicate]

I am now learning keyed hash function, where A and B share a secret key k. I want to know if the ordering of encryption E and hashing H matters? i.e. Is there any difference between H ◦ Ek (m) and Ek ...
3
votes
4answers
503 views

Irreversible hashing without collision

We are looking to allow users to log on with a smart card. The smart card reader can read the smart card ID and send it to us. We are, however, not allowed to store the smart card ID. Not in ...
-1
votes
1answer
105 views

Password sending through network [duplicate]

In case of no TLS/SSL available, why can't I use the hash of the password (SHA512) as the key to encrypt the password (with out any salt) to send through the network ? MITM attacks I can understand, ...
4
votes
5answers
563 views

Use the hash of the password to encrypted password

I have a app which transmit the password in clear text. I was planning to use the hash of the password (SHA-512) as the key for encrypting the plain text password. Then send the encrypted text to the ...
7
votes
1answer
467 views

Does bcrypt on top of md5 reduce its security?

A GitHub project I recently checked has a flawed security as they're using an unsalted md5() to hash the passwords. I opened a bug and they acknowledged it. However, the transition from md5() to ...
2
votes
0answers
191 views

How do I convert from this weird John/Asleap format to lc (for HashCat)?

I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
0
votes
2answers
183 views

How secure are hashed passwords that are salted too?

SAP Netweaver has its passwords hashed and also salted. But I read that a tool such as John the Ripper can bruteforce them. So how does security varies when passwords are hashed, in particular in the ...
4
votes
4answers
391 views

usernames and passwords

I was thinking about usernames and passwords and I was wondering how secure it would be to instead of the server having a list of usernames and accompanying hash of the passwords, just have a list of ...
32
votes
5answers
6k views

How does hashing work?

I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it ...
1
vote
1answer
231 views

What key to use in HMAC

I need to use HMAC on a certain message to guarantee integrity, but I cannot figure out what are the requirements for the key to be given as input to the hashing algorithm. In particular I have to ...
6
votes
3answers
598 views

Are online hash calculators dangerous?

I was about to use an online MD5 checksum calculator when I realized that my result could be added to a database. This is significant because the string I was going to type in was my bank password. ...
4
votes
3answers
917 views

symetric key encryption vs hashing

This is a fascinating document: top 100 passwords from adobe breach I have a question about one part of it: However, thanks to Adobe choosing symmetric key encryption over hashing, selecting ...