A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

4
votes
3answers
241 views

Is it good practice to SHA512 passwords prior to passing them to bcrypt?

I want to allow any-sized passwords to be allowed to be submitted. I currently use bcrypt as a key derivation function for passwords, however I have realized that it has a maximum input length of 72. ...
0
votes
2answers
242 views

Storing multiple hashes to prevent collisions, security risk?

This is all just for curiosity's sake, so discussion on which hashing algorithm is harder/better/faster/stronger is irrelevant. But my question/thought is this.. With regards to password storage, and ...
1
vote
4answers
186 views

Hashing Email Address and Contacting User

I am thinking about a log-in web service that would store a users username, password, and (optional) email address. If they forget their username or password, they can have their username and a ...
-1
votes
4answers
237 views

Is salted MD5 or salted SHA considered secure?

Is using something like bcrypt or scrypt necessary? The hashes are so much longer to store in a database. Can one get away with using salted MD5 or SHA and still be secure?
0
votes
2answers
106 views

Is a long salt usually sufficient for security purposes, even with MD5?

I always hear that MD5 is too fast for effective password crypto because you can crack up to 6 characters very quickly (or is this number higher now)? But what if the salt you use is really long and ...
0
votes
2answers
78 views

Why RSA signatures based on the hash of the message? [closed]

Why RSA signatures based on the hash of the message rather than the message itself?
2
votes
2answers
544 views

Protecting hidden form fields

The scenario is as follows: An application has a web interface through which data can be configured. The data to consider for this question is Users with a many-to-many relationship with Groups. ...
1
vote
1answer
86 views

Log file checksums

I am told that you can tell if the log file (like from ripping a CD) has been modified by its checksum. How? How do you bypass this if you wanted to modify it?
2
votes
1answer
77 views

Identical lanman hashes on AD accounts?

I ran metasploit's smart_hashdump module against my (2008r2) domain controllers, trying to find any accounts that may still have lanman hashes in place. These should have been disabled long ago. I'm ...
5
votes
3answers
425 views

comparing password hashing algorithms - PoC ideas?

OK so I just started working for a security consulting firm and we recommend SHA 256 (with salt) for password hashing because MD5 is too weak. I have read some brilliant answers (the list is too ...
1
vote
1answer
137 views

What are the enhancements of SHA1 compared to MD5?

I am looking for enhancements of SHA1 when its compared to MD5. But I am not talking about just heap sizes. I am talking about different enhancements than heap size. Also, I think md5 is faster than ...
3
votes
1answer
90 views

Is it possible to slow down the Blue Midnight Wish cryptographic hash function?

In the Blue Midnight Wish (BMW) cryptographic hash function, is there a variable I can use to increase memory/CPU resource consumption to slow down the password hashing process? Call me crazy, but I ...
1
vote
2answers
103 views

Can I save & store a user's data in a way that proves that the information has not been altered, and that the timestamp is accurate?

There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service ...
3
votes
2answers
213 views

MySQL ENCRYPT salt is not random?

I know there's little reason to still use ENCRYPT() nowadays, what with bcrypt being almost ubiquitous and MySQL providing better hashes such as SHA1. But while dabbling with ENCRYPT() on MySQL ...
0
votes
2answers
139 views

Why do file storage sites have a long unique id for their download links?

I'm creating a file storage site and what I would do is just have the download links format as: https://www.domain.com/[id]/[file name] //id would just be 1, 2, 3 etc. Dropbox and many others have ...
1
vote
2answers
62 views

A manual function for hasing identity?

I hope you won't close the question. Even though there are no computers involved, it is still about information and security, and I think that security experts are the ones who will be able to help ...
10
votes
3answers
1k views

HMAC Based Request Signing - Storing the Salt

I'm working on a (non high security) project that currently isn't live but might go live at some point. We have a REST API (implemented using Restlet and Neo4j) running on a server and an Android ...
0
votes
4answers
1k views

What are the advantages/disadvatages of hashing over encryption?

I know that hashing is a one way function and encrypted messages could be retrieved if you know the corresponding key to which you encrypted the message. Other than the ability to retrieve, what ...
4
votes
1answer
68 views

Will my method for managing account data work?

I'm looking at whats nessecary to create a small accounts server for a video game I'm programming in my spare time. User privacy is a very important topic for me, and I don't want to keep anything ...
2
votes
2answers
573 views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
113
votes
11answers
30k views

Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?

Why can't a password hash be reverse engineered? I've looked into this ages ago and have read lots on it, but I can't find the explanation of why it can't be done. An example will make it easier to ...
1
vote
3answers
264 views

What part of the CSR is hashed in order to create its signature?

I'd like to change the CSR before it is transferred to the CA without going through the CSR creation process again. To do that I need to know how to calculate the signature of the CSR after I modified ...
4
votes
3answers
590 views

Is there a hash algorithm that can identify similar files or strings?

Is there a hash algorithm that will help you identify similar files or strings? For example, the hash for ABC and XBC would be similar rather than radically different as is usually the case. I know of ...
2
votes
2answers
204 views

Locality Sensitive Hash (LSH) function to approximately match old passwords

Recently, I ran across a website that requires me to change my password after X number of days had passed since I had last created one. Intelligently, the service made sure that the password did not ...
5
votes
9answers
4k views

What is the best way of securing a website logon without SSL or preshared keys?

Today I sniffed some unencrypted wlan traffic during class and I found quite a few passwords by a simple search for "pass" and "user" in wireshark. Turns out about half the sites we use for school ...
15
votes
2answers
581 views

Can client-side hashing reduce the denial-of-service risk with slow hashes?

When storing user's passwords that you need to verify against (but not use as plaintext) the current state of the art is: Hash the password Use a salt Use a slow hash function - bcrypt, scrypt, etc. ...
19
votes
2answers
12k views

Why are GPUs so good at cracking passwords?

What is it about GPUs that lets them crack passwords so quickly? It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
4
votes
11answers
4k views

Definitely safest password storage scheme?

I already asked this on StackOverflow but I was suggested this would be a better suited place and I found no way to "move" the question so I have to copy it. Believe, I know, there are hundreds ...
4
votes
5answers
616 views

Expanding/Inverse Hash function

First off, before I ask my question, let me explain what I am NOT asking. I am NOT asking for a way/method to reverse a hash output; by definition, a hashing function is one-way. Is there such a ...
2
votes
1answer
195 views

Any reason I shouldn't be salting and hashing before putting through bCrypt?

I've been reading up on password storage and such, and have come to the conclusion that I need to be using bCrypt. I've got an implementation working correctly, but I'm wondering the best way to move ...
0
votes
1answer
61 views

Find hash-function if original and hash are given? [duplicate]

I was thinking whether or not you can find the hash function(s) used if you have the original message and the hash. So assume that no salt is used during the hashing process, just multiple hashing and ...
1
vote
1answer
294 views

How do we estimate the time taken to crack a hash using brute force techniques

A German hacker famously managed to brute force crack a 160 bit SHA1 hash with passwords between 1 to 6 digits in 49 minutes. Now keeping everything constant (hardware, cracking technique - here ...
-1
votes
1answer
105 views

Hash leaked online

Recently I Googled the email address of one of my friends, as I was just curious of what would come up. Lo and behold, he saw what presumably is his Gmail hash. It is part of a list of 10,170 email ...
0
votes
0answers
32 views

Hashing / How easy is it to infer the original input if the a slight variation of the input, the hash result and the hashing algorithms are known [duplicate]

Given that I have an initial input that is publicly known (e.g. "ABCDEFGHIJ") a slight variation of (1) (e.g. "BACDEFGHIJ") that is used as the input to a hashing algorithm (3) an modern one-way ...
2
votes
1answer
116 views

Stream/Block encryption using XOR and Hash function?

Could a hash function like sha1 or ripemd-160 be used for secure key generation in a stream/block cipher? Obviously a repeated key like "abc123abc123abc123" would be bad, and a one time key pad would ...
0
votes
1answer
77 views

In IKE protocol; what is the PRF? [duplicate]

In IKE protocol; what is the PRF ? What is "the generation of a key based on modeled random oracle hash functions"?
1
vote
1answer
157 views

Challenge-response login without storing a password equivalent

A problem with many challenge-response login systems is that the server has to store a password equivalent. For example, if the server stores SHA1(salt + password), and an attacker captures that hash, ...
3
votes
4answers
650 views

Can I brute-force a password hash even if I don't know the hash-algorithm used?

Can I brute-force a password hash even if I don't know the underlying algorithm? For example if I get hold of a database with password hashes and the used hash algorithm is unknown, like a random ...
2
votes
1answer
154 views

PRF, IKE and hash function

The term PRF is mentioned in the documentation of the IKE (Internet Key Exchange) protocol. What is a PRF? What is the difference between a PRF and a hash function? What PRFs are used in the IKE ...
3
votes
4answers
143 views

Record IP pseudonymously?

I'd like to be able to ban an IP from my website, but for privacy reasons I would like to not have a record of the IP itself. Hashing the IP would allow for the hash to be brute forced in mere ...
1
vote
1answer
469 views

How to identify hashing algorithm [closed]

I want to identify the hash algorithm used by an online service. What I have now is thousands of pairs of original string and result hash. Some examples: 62.152.39.195 25d10817d8d2836925 ...
0
votes
2answers
586 views

Securing passwords for REST Authentication

first post on sec so go easy. I'm developing a REST application using the Spring Framework, as as part of the requirements, we have to secure the different functions of the system to different user ...
0
votes
2answers
139 views

Asymmetric Data Storage+ No-Hash Password Storage?

Edit: removed a part of the original question; I'll break it down in a different post. I am following @Polynomial's answer to store information in a database. Here are my requirements: Only the ...
3
votes
2answers
1k views

Is it a good idea to store Email addresses as hash only?

I am currently building a web service at http://write-math.com similar to http://detexify.kirelabs.org/ that should help users to get LaTeX code from drawn formulae. It is part of my bachelors thesis ...
-3
votes
2answers
501 views

Can NSA generate all hashes for rainbow table to break md5?

I was wondering about md5 encryption. It is good, and I agree that it is unbreakable. But this is why we have rainbow tables. What if bunch of people gather together and start brute forcing and ...
1
vote
1answer
2k views

Cracking Mysql 5 Hash using Hashcat

I am practicing cracking MYSQL5 hash using hash cat, however, for a reason or another, it finishes the cracking process too fast -within 30 seconds- without giving any results/errors back. I doubted ...
2
votes
3answers
552 views

Hashing speed with true random passwords

Just a theoretical question: If I had ideal users, who all provide fully random 128-bit passwords, And also, I invalidate every password shorter than 128 bits. Then would I still need a slow hash ...
0
votes
4answers
171 views

Password Hashing Without a Unique Salt

I have a question about password hashing. This is not a question about the the BEST POSSIBLE method of hashing passwords, but rather a more utilitarian question about what is sufficient to hash a ...
2
votes
1answer
159 views

Hashed passwords for NTLM authentication

I understood that Windows users' password hashes can be exported very easily. Right? So my question is: If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't ...
9
votes
6answers
2k views

Should I hash a password if it is randomly generated

The best practice is we should hash a user password using algorithms such as bcrpyt to protect the user, however, given the following conditions, is hashing in the backend still matters? the ...