A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

2
votes
2answers
612 views

Why is a CSR hashed?

What are the use cases for defining something other than the default SHA1 hash in a CSR? Is it to protect the digital signature, public/private keys? What is it protecting exactly?
2
votes
2answers
232 views

Keyed-hashing a password with a hash of the password + salt as the key, is it safe?

I was looking at our authentication system which hashes passwords differently than I was taught. The salt is a constant byte array and it uses the password + the salt as a key for the password hashing ...
1
vote
3answers
386 views

Site allows both Partial and Complete password authentication; do they have my password in plain text? [duplicate]

My bank provides online banking facility like most of the banks these days. On the web they have Partial Password Authentication. Although I don't really believe in PPA providing extra security but ...
0
votes
1answer
5k views

About password_hash() in PHP and storing (part of) its salt outside DB

So, i learned that new in PHP 5.5 is password-hash() which works much like crypt(). Which is more secure (slower) than md5() or sha1(). The result string is algo+hash+salt, which can be passed as-is ...
0
votes
2answers
364 views

Why do file storage sites have a long unique id for their download links?

I'm creating a file storage site and what I would do is just have the download links format as: https://www.domain.com/[id]/[file name] //id would just be 1, 2, 3 etc. Dropbox and many others have ...
0
votes
2answers
143 views

Why RSA signatures based on the hash of the message? [closed]

Why RSA signatures based on the hash of the message rather than the message itself?
9
votes
6answers
1k views

Does repeating one word to form a password result in a similar pattern in its encrypted format?

If i use a single word to form a password by repeating it like the examples below: securesecuresecuresecuresecuresecure SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe $eCuRe$eCuRe$eCuRe$...
9
votes
2answers
801 views

How to store/encrypt fingerprint?

Storing password is a no brainer : use a password hasher. But.. How do you proceed to store fingerprints securely on your server? Meaning that even if your server and all it's data is stolen, someone ...
9
votes
1answer
2k views

HKDF and key stretching

I thought that all key derivation functions would do a key stretching phase, by iterating some kind of process. But I can't see that process in HKDF. HKDF doesn't do key strengthening? If I have a ...
7
votes
2answers
828 views

Implementing Secure Remote Password: Constructing the verifier

The SRP protocol as described in RFC 2945 generates the password verifier: x = SHA(<salt> | SHA(<username> | ":" | <raw password>))` v = g^x % N I have three questions: why use ...
7
votes
3answers
1k views

How should I choose a difficulty factor for my password hashing function?

Assuming that I'm doing password hashing properly and using bcrypt, scrypt or PBKDF2, how should I go about choosing an appropriate difficulty factor? i.e rounds for bcrypt, iterations for PBKDF2 and ...
7
votes
4answers
5k views

when people say a file has a checked md5 hash, what exactly does that mean?

ok I was just reading this site: http://www.zdnet.com/blog/bott/stay-safe-online-5-secrets-every-pc-and-mac-owner-should-know/3542?pg=4&tag=mantle_skin;content and thought of something I always ...
5
votes
2answers
4k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...
5
votes
1answer
153 views

Random padding in hash functions

In this answer, it was recommended that you add random padding when hashing messages for a trusted timestamp, such as for predictions, in order to avoid dictionary and brute force attacks (at least ...
5
votes
2answers
2k views

What is better salted hash or openssl encryption?

Im using php and I was looking to store passwords in a mysql database. I was wondering what would be safer to use a salted hash or openssl encryption? If i use a unique random generated salted hash ...
4
votes
1answer
2k views

What is the best way to store passwords in OpenLDAP?

I would like to store user credentials in an OpenLDAP or similar directory server. A lot of online commentary about storing passwords in modern contexts recommends using password derivation schemes ...
4
votes
1answer
2k views

How to implement WSS UsernameToken when password on the server is salted and hashed?

I'm currently trying to write a web service for customer and requirement is to use WS Security. On their server side, they have passwords stored as SHA-1(salt+password). According to WSS spec, ...
4
votes
1answer
443 views

Hashed passwords for NTLM authentication

I understood that Windows users' password hashes can be exported very easily. Right? So my question is: If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't ...
4
votes
2answers
566 views

Keepass Dictionary Attack Protection Strategy

Though pretty interested, I'm everything but an expert in Information Security, please redirect me to any helpful resources if my question is stupid or correct me if my assumptions are wrong. When ...
3
votes
4answers
948 views

Convert SHA-256 to SHA-1 and MD5 - Increase bit length/entropy? [duplicate]

I know this is a real dumb question and I am certainly talking complete rubbish, but let me explain: We have a long SHA-256 hash, e.g.: ...
3
votes
3answers
2k views

Hash Function Xor

For a hash function what is the best secure method, XOR or Concatenate: h(data1 XOR data2 XOR data3 XOR data4) ? or use h(data1||data2||data3||data4)?
3
votes
3answers
337 views

Does the hash change the security of the Secure Remote Password protocol?

I'm implementing the Secure Remote Password protocol, and similar to this question, I'm wondering if I can use the SHA-512 hash function instead of SHA-1 currently being used. Would this help improve ...
3
votes
2answers
640 views

What is considered a reasonably high iteration count?

I copy-pasted a function that implements the PBKDF2 hashing algorithm in PHP. The function asks for the amount of time that I would want it to loop in order to produce a hash. Now, I'm wondering, ...
3
votes
3answers
555 views

Client-Side Hashing to decrease value of password guessing heuristics

Yes, this is 'yet another client-side hashing' question. But, don't leave yet, I think there is some value here. I'd like to do something to mitigate the affect on the community as a whole when my ...
2
votes
2answers
388 views

Reducing hash output length [duplicate]

I am using output of (keyed) hash function to make sure the input was not modified, I store it along with input. Now output of SHA-1 is 20 bytes. Say I want to reduce the output. And have it output 10 ...
2
votes
0answers
54 views

Disallowing Similar Passwords [duplicate]

Upfront, I want to clarify that I am not a professional cryptographer, I am more curious about playing with the math and science behind it, and also want to improve my habits with my own personal and ...
2
votes
1answer
1k views

What is the collision chance of a 128-bit hashing function if it is always fed with 256-bits of data?

I mean "normal" collisions not based on any attack. How do i calculate it?
2
votes
1answer
572 views

Legality and ethics of cryptanalysis on password hashes

I'm working on my dissertation concerning cryptanalysis on password hashes. I'd like to delve into the legal and ethical aspects of cryptanalysis, however, seeing as I'n not at all well versed in law ...
2
votes
2answers
1k views

Does it make any difference of the order Hashing and Encrypting in terms of security?

I am implementing a password vault program with java. I have programmed a triple DES for encryption and a SHA256 for hashing. My question is would it make any difference if I first hash the raw data ...
1
vote
2answers
2k views

Extract Password Hashes from Active Directory LDAP

Currently we are working on a monthly internal security test which among other should contain a verification of the real password strength the users choose. For this reason I want to extract the ...
1
vote
1answer
86 views

PBKDF2 constants

I recently found this PBKDF2 code: <?php /* * Password Hashing With PBKDF2 (http://crackstation.net/hashing-security.htm). * Copyright (c) 2013, Taylor Hornby * All rights reserved. * * ...
1
vote
2answers
172 views

Should hashing hashed hashes colide or not?

Since key stretching basically boils down to hashing hashes over and over again (where salt, pepper and password individualize the hash function, but the principle remains the same), I wonder about ...
1
vote
2answers
227 views

What if the Local Windows Cert Store is Compromised?

The diagram below illustrates chaining digital certificates up to a publicly trusted Root Certificate: I have been researching how trusted root authorities (such as GlobalSign or Verisign) are used ...
0
votes
2answers
100 views

Is there a cryptographic function that generates a reconizable visual pattern?

I have to build a system that will ultimately print a pass allowing access to a building. The validation of this ticket will be done manually (it can also be automatic but that's not likely at this ...
0
votes
5answers
1k views

What if I develop my own hash algorithm to create strong passwords from easy ones?

I came up with this idea but I cant figure out if it's good or bad, maybe you can help. My goal is: I want to create extremely strong passwords for my main accounts (gmail, skype and so on). I want to ...
0
votes
2answers
479 views

How can I identify this hash? [closed]

I'm trying to decrypt my router's root password, since I only have access to a simple admin account that doesn't have root privileges. Here is the passwd file: 0:F.bCrWv/Oxp6.:0:0:root:/home:/bin/sh ...
0
votes
2answers
107 views

Secure password generation for different websites [duplicate]

I came up with the idea to generate passwords for internet sites by the following shema: $masterpassword $hostname $TLD hashfunction($TDL.$masterpassword.$hostname) So the actual password is a ...
0
votes
2answers
123 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
0
votes
3answers
449 views

Testing a password for similarity to previous hashes

This question is a follow-up to a comment by Tobias Kienzler to an answer to "What is the purpose of the “Password minimum age” setting?". Consider a password policy that new passwords cannot be ...
-1
votes
2answers
77 views

Website says my new password can't be used because it is the same as an old one [duplicate]

What are the risks of storing (in hashes I guess) all the old passwords? Why would a company chose to not delete old passwords? Why not let users reuse old passwords?
-1
votes
1answer
58 views

Shouldn't multiple images always exist even in most powerful hashing algorithm?

I have a confusion in mind that since in hashing we transform a large string into a smaller fixed size string, so its unlikely that any large string has a unique hash. There had to be collisions and ...
-3
votes
2answers
78 views

When should a password be hashed? [duplicate]

I develop a Smartphone App and have a little question: When should I hash the user passwords, on the device or upload them in plain text and hash them on the server before stored in the database?