A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

1
vote
1answer
230 views

What key to use in HMAC

I need to use HMAC on a certain message to guarantee integrity, but I cannot figure out what are the requirements for the key to be given as input to the hashing algorithm. In particular I have to ...
7
votes
6answers
789 views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
4
votes
3answers
905 views

symetric key encryption vs hashing

This is a fascinating document: top 100 passwords from adobe breach I have a question about one part of it: However, thanks to Adobe choosing symmetric key encryption over hashing, selecting ...
2
votes
1answer
85 views

MITM vs. data leakage

We are designing a web API - accessible via https only - but two schools of thought seem to have arisen among our team: Group 1 wants to adopt an approach that is more concerned about data leakage ...
3
votes
4answers
394 views

How to tell if a site is securely storing passwords? [closed]

A site I frequent has a policy to make you change your password every 90 days. That's a cool policy, but I stumbled upon an old xkcd and facepalmed myself, because lots of doxing happens on this site. ...
4
votes
3answers
446 views

Is there a hash algorithm that can identify similar files or strings?

Is there a hash algorithm that will help you identify similar files or strings? For example, the hash for ABC and XBC would be similar rather than radically different as is usually the case. I know of ...
1
vote
1answer
477 views

Reversing a block hash of SHA-1 with known Plaintext?

Is it possible to reverse the hashing of a block in a Datastream fed to an SHA1 if the plaintext for that block is known? If it is not possible (which I assume) does it make attacks to retrieve the ...
1
vote
3answers
251 views

Brute Force In Order Or Random?

Which is faster, on average to find the original plain text of a hash: brute force in-order, or with random plaintexts?
0
votes
2answers
233 views

scrypt strength with “weak” salt

I'm working on a project where following constrains apply: There's no remote database or any other means of storing extra data like random salt When user logins in, only username and password are ...
8
votes
4answers
534 views

At what point does adding more iterations to PBKDF2 provide no extra security?

If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an ...
2
votes
1answer
1k views

Are there sha 512 rainbow tables available? [closed]

Are there sha 512 rainbow tables available for download or what kind of dimensions and processing power would be required to generate them?
3
votes
1answer
580 views

Reverse-engineering password salts

Lets set out a scenario, a database has been dumped and all the passwords are hashed. You notice that some users seemed to have signed up twice and have the same hash. You run these hashes through ...
0
votes
1answer
72 views

Payload authentication + HW-SW Binding

I want to authenticate a (2nd stage) bootloader during the boot process using a symmetric key, which is derived from HW properties of the platform the bootloader is running on. Thus, I want to bind ...
0
votes
1answer
442 views

Is this password hashing + salt method the most secure way possible? [duplicate]

I am just wondering what all the security experts think of my method for password hashing. I want to come up with a method I can use for all my future web development projects. First I create a ...
4
votes
3answers
344 views

comparing password hashing algorithms - PoC ideas?

OK so I just started working for a security consulting firm and we recommend SHA 256 (with salt) for password hashing because MD5 is too weak. I have read some brilliant answers (the list is too ...
0
votes
2answers
147 views

Would multiple exposed bcrypt hashes of the same UUID v4 with random generated salt be too insecure?

I'm looking into implementing an ownership check on JSON objects and want to avoid going back to the database to ensure ownership of said object/record (i.e., to prevent a user from updating an ...
0
votes
2answers
446 views

Does using Bcrypt to encrypt credit card numbers satisfy PCI compliance?

I understand that using MD5 is not safe and is not PCI compliant. Does using BCrypt satisfy PCI compliance
9
votes
4answers
521 views

How can I be secure with a global salt?

If I understood the basic of password hashing and storing, what we need are: a "strong" salt a "real" random salt a unique salt per password a password hashing function with a high CPU cost We ...
1
vote
1answer
2k views

Brute force password cracking with a GPU

How are GPU's provisioned for password cracking? Do all, if not most cracking programs have special GPU aware software or do they just function at the basic driver or API level of the device? Can it ...
1
vote
2answers
780 views

How can I check the integrity of the downloaded files?

I know we use hash functions to check for the integrity of the files etc... but my question is how can we check for the integrity of the files being downloaded from some server?
0
votes
1answer
260 views

The Hash header in GPG ASCII armor

When sending a signed message using GPG, it always includes a line that says Hash: SHA256 right at the top of my email. I was wondering if/why it's required, and if not, how I can remove it (in an ...
0
votes
2answers
411 views

Algorithm to generate NTLMv2 Hash in PHP

I am trying to develop a PHP function to calculate NTLMv2 hash by providing server & client challenge, domain, account and password. The resulting hash appears to be not correct. Can someone ...
5
votes
4answers
590 views

Secure authentication: partial client-side key stretching… please review/criticize my idea

I am trying to figure out what would be the 'perfect' authentication system for a website. On one end, we know that simple hashing algorithms can be brute-forced or cracked in other ways. Hence why ...
1
vote
2answers
263 views

Could a user never store a password if a username/email hash was used instead?

So I was just thinking about token_authenticatable setup from devise (rails gem), and this thought occurred to me: Could we strengthen web security by hashing username/password with javascript before ...
0
votes
1answer
234 views

Challenge, Authentication and session key

I programmed an application on Linux using C, I added an authentication and cryptography layer that's going like this : 1 -client sends connection request. -server send a random challenge to client. ...
1
vote
1answer
2k views

John the ripper passwd file format with salt not working

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is: $hash = md5($salt . $pass) No other ...
3
votes
2answers
317 views

Is there any way to cryptographically hash a human thumbprint?

Is there any way to cryptographically hash a human thumbprint into a form that can be consistently reproduced by thumbprint readers? Assuming that it would be possible to create a database of ...
10
votes
4answers
1k views

How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?

I'm new to cryptography and its implementations. I'm designing an Android app where an user enters a password to retrieve some encrypted data. After some research on possible solutions I ended up with ...
9
votes
2answers
619 views

Does it make sense to choose a longer password than the output of a hash?

Let's take MD5 for example: It outputs a 128-bit hash. Does it make sense (in theory) to choose an input (password) which is itself longer than 128-bit? Does it increase the probability of a ...
0
votes
2answers
886 views

Finding out whether a website uses unsalted MD5 for password hashing

I'm working on a project where websites are analyzed and rated according to password security (factors like min/max password length, alphabet size and more are then calculated into a score). A great ...
6
votes
3answers
204 views

Would secure storing of past used/generated passwords be a good idea?

Let's assume an organisation that generates ~100 Passwords a week; these Passwords are 32-Characters long and randomly generated. The consultants that need passwords generated use a Password-generator ...
1
vote
2answers
205 views

How can I generate a unique SALT for multiple apps sharing one user database?

Let's say that I have one Database, and several separate web applications that share the database. If hashes are to be unique and generated on the server-side, how can I ensure that I am generating a ...
3
votes
1answer
667 views

Hashing passwords before inserting into database

For the last 2 weeks I have been reading many blogs about website security and hashing passwords. Many sites have mentioned the pro's and cons about different ways of doing this, which has left me a ...
6
votes
3answers
152 views

Is it safe to store hashes of possibly non-existing passwords in a less safe way?

I would like to implement a lockout mechanism that not only protects against same username and many passwords attacks, but many usernames and same password attacks too. To implement this I figured I ...
4
votes
2answers
465 views

What is the purpose of a Pepper?

I've been trying to find out exactly what a pepper is. The only things I could accurately determine are that a Pepper: Is theoretically unique from site to site and hard-coded in the site's source ...
10
votes
6answers
2k views

Do salts have to be random, or just unique and unknown?

First of all, my motive is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database. After discussion in comments and in ...
3
votes
5answers
283 views

Are hash functions “strongest link”?

It seems to me that if you were to use multiple hash functions, the "strongest link" would hold up the others. For example: HelloWorld --- md5 --> 68e109f0f40ca72a15e05cc22786f8e6 --- sha256 ...
0
votes
2answers
1k views

how to know what hash function have been used

I have a hashed password and the plaintext password and i want to know the exact algorithm that's been used. I have the input and the output of the hash/encription algorithm. How would I know what ...
1
vote
3answers
471 views

Password Security and ocl-Hashcat-plus

I recently read the Ars Technical Article about new features in ocl-Hashcat-plus. In light of questions like: Long Passwords: How are they more secure? and XKCD #936: Short complex password, or ...
2
votes
1answer
2k views

Which part of the eapol packets contain WPA password Hash?

I have captured wifi traffic from a WPA network using Wireshark. I filtered the results for "eapol" packets and noted in the info column there are message type 3 and type 1. I believe this is two ...
23
votes
8answers
2k views

Why is password hashing considered so important?

After reading this article, I can see the benefits of password hashing as a second layer of defence, in the event of an intruder gaining access to a password database. What I still don't understand is ...
0
votes
3answers
162 views

Devising encryption schemes and protocols

I am wondering how encryption schemes are developed and why certain decisions are made. For example. I have seen a company hash a string with SHA1 and then RSA encrypt it. Why? I've also seen the ...
2
votes
4answers
230 views

Why do some passwords not allow certain types of characters?

Is there any programing related reason why some password cannot have certain characters? If the idea in storing a password is to store it's hash, since a hashing function can take any input (ok at ...
1
vote
1answer
149 views

Is double hashing bad? [duplicate]

I hear rumors that double hashing is bad... like hash("sha512", hash("whirlpool", "string")) Is it bad and less secure? if so why? Thanks for any help!
6
votes
2answers
363 views

Salt placement prior to one-way hash

In one-way hashing its common to prepend or append the salt to the secret and then hash it: (salt + secret) or (secret + salt). I was thinking of this metaphor as salt falling on a plate of food. It ...
0
votes
3answers
226 views

Need references about why public access to a password hash and salt is poor practice

What are some published industry standards about why revealing the password hash and salt are poor or bad practices from a security perspective? I am dealing with a vulnerability where anyone can ...
2
votes
3answers
231 views

Is there any reason I shouldn't use SHA1 of salt + website name + master password for my password in websites?

I considered writing a program to do the above for websites I only intend to use for short-term use.
-3
votes
3answers
2k views

Generating an unguesable token for confirmation e-mails

I'm generating a token to be used when clicking on the link in a verification e-mail. I plan on using uniqid() but the output will be predictable allowing an attacker to bypass the confirmation ...
2
votes
1answer
204 views

Unknown encryption string [closed]

I'm trying to learn about encryption and decryption methods when I faced this string: {MD5}JfnnlDI7RTiF9RgfG2JNCw== MD5 is 16-byte string, so anyone know what type of encryption is this and why ...
3
votes
2answers
387 views

Is mt_rand() suitable for generating a salt?

Assumed I have to following code in order to generate a random blowfish salt for saving a new password: $blowfishCharacters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./'; $salt ...