A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
3
votes
6answers
293 views
Is there a table that compares hashing algorithms by speed, relatively (machine independent)
As far as I understood*, one of the major criteria when choosing a password / salt hashing algorithm is it's speed. To prevent brute force attacks, a slower algorithm is better (and also makes it more ...
3
votes
2answers
249 views
Does it make any difference of the order Hashing and Encrypting in terms of security?
I am implementing a password vault program with java. I have programmed a triple DES for encryption and a SHA256 for hashing.
My question is would it make any difference if I first hash the raw data ...
3
votes
3answers
291 views
Hash Function Xor
For a hash function what is the best secure method, XOR or Concatenate:
h(data1 XOR data2 XOR data3 XOR data4) ? or use h(data1||data2||data3||data4)?
3
votes
1answer
377 views
Is this security/encryption scheme secure?
I'm rolling my own, personal threetags.com-style 'encrypted data in the cloud' webapp (I didn't like the UI, and lack of non-browser client).
However, I have absolutely no experience with security ...
3
votes
2answers
720 views
What is better salted hash or openssl encryption?
Im using php and I was looking to store passwords in a mysql database. I was wondering what would be safer to use a salted hash or openssl encryption? If i use a unique random generated salted hash ...
3
votes
4answers
195 views
Are there any websites that gather hash sums of different disk image files?
For example the SHA256sum of an Ubuntu ISO image, or an OpenBSD amd64 image. Are there any sites?
It's important that the site must use HTTPS or at least it must provide GPG check for the hashes.
3
votes
2answers
246 views
MD5 display format
When I run MD5 algorithm I am getting an output in numeric and a few lower case letters. Obviously it uses all numeric digits and rarely i saw some lower case alphabet letter. I need to understand ...
3
votes
2answers
259 views
Program binaries or files with same MD5 hash
I'm looking for 2 different program binaries or 2 different files with the same MD5 hash to prove its weakness and the collisions in the algorithm.
3
votes
5answers
359 views
The security level in hash function
What is the difference in security between using part of message digest hash function or all the message digest hash function? and is there any equation can calculate the security for part or whole ...
3
votes
2answers
292 views
How does processor architecture affect password hashing speed?
Does hashing speed vary significantly using different architectures (x86 vs ARM)?
Scenario
I am investigating the possibility of using a cluster of Raspberry Pi for cracking passwords hashed with ...
3
votes
3answers
234 views
Is it safe or even common to cache bcrypt checks in-memory
In a web application that (as a side effect of implementing the password anti-pattern) stores passwords, one recommendation is to bcrypt to store them (or computationally expensive one-way salted ...
3
votes
2answers
125 views
Doesn't adding requirements to a password, such as must contain 2 digits, decrease the strength? [duplicate]
Possible Duplicate:
Doesn’t imposing a minimum password length make the password weaker by reducing the number of possible combinations?
Doesn't any constraints added to a password policy ...
3
votes
5answers
337 views
Am I required to hash passwords
Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen?
If not required in the US, but required in the ...
3
votes
2answers
132 views
Confidentiality and integrity for web session
When the client authenticates with our service, he is issued an opaque "token". This token includes the information, that identifies the client and some other information about the client ("payload"). ...
3
votes
3answers
166 views
What pros and cons are there to a one-time random salt between client and server?
In researching on best practices in hashing passwords using a salt I came across a presentation on slideshare. The approach outlined is as follows
Client requests login page
Server-side code ...
3
votes
1answer
608 views
How to apply FIPS to Microsoft Access database with custom VBA
As the software engineer on a project, I have been asked to make a Microsoft Access application, with custom interfaces running custom VBA. That part is going just fine. Recently though I was asked to ...
3
votes
5answers
146 views
Expanding/Inverse Hash function
First off, before I ask my question, let me explain what I am NOT asking. I am NOT asking for a way/method to reverse a hash output; by definition, a hashing function is one-way.
Is there such a ...
3
votes
1answer
128 views
Key length and hash function in PBKDF2
On this page:
http://www.ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL/PKCS5.html
they make a statement that strikes me as rather weird:
Key Length
Specifies the length in bytes of ...
3
votes
4answers
200 views
When hashing passwords, is it okay to store the algorithm used right there in the database?
Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
3
votes
2answers
102 views
What's the point of using multiple checksum algorithm with “aide”?
In aide the author offers more than one hash algorithm to do the check-sum, why is that?
Aren't a single one, i.e sha512 enough for determining file changes? I believe these algorithms are all ...
3
votes
5answers
276 views
What about combining pkdf2 with scrypt? [duplicate]
Possible Duplicate:
Would it make sense to use Bcrypt and PBKDF2 together?
How does the following password hashing scheme look to you?
iterations1 = scrypt iterations required to spend ...
3
votes
2answers
232 views
Is the password hash better when you concatenate the password and username?
Is the password hash (with bcrypt) better when You concatenate the username with password?
For example:
$this->hash($username . $password);
and
$this->hash($password);
Last time I used ...
3
votes
3answers
173 views
Does the hash change the security of the Secure Remote Password protocol?
I'm implementing the Secure Remote Password protocol, and similar to this question, I'm wondering if I can use the SHA-512 hash function instead of SHA-1 currently being used. Would this help improve ...
3
votes
1answer
89 views
What are the implications of omitting the username in Secure Remote Password's verifier?
I consider implementing a Secure Remote Password (SRP-6a) verifier that omits the username from the x key hash. The intention is to allow authentication with multiple alternate user identifiers such ...
3
votes
2answers
239 views
What is considered a reasonably high iteration count?
I copy-pasted a function that implements the PBKDF2 hashing algorithm in PHP. The function asks for the amount of time that I would want it to loop in order to produce a hash.
Now, I'm wondering, ...
3
votes
2answers
119 views
what is the difference between a mac and a digital signiture
I understand that a MAC algorithm takes a message and a private key as input and hashes them to a value. I understand that senders and receivers often use MACs to authenticate a message and check the ...
3
votes
2answers
99 views
Fixing the high-bit problem in PHP's crypt() implementation
I'm working on a site that has to have compatibility with older versions of PHP, which suffer from a high-bit issue in the Blowfish crypt() implementation. Essentially, non-ASCII characters are not ...
3
votes
2answers
203 views
is it easier to get the original password if you have multiple hashes of it?
Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
3
votes
1answer
187 views
Replacing weak SSH fingerprint algorithms
Even though MD5 has been broken for years and its vulnerabilities have been used to create real-world rogue X.509 CAs and other horrible things, OpenSSH and PuTTY still use MD5 as the default public ...
3
votes
3answers
164 views
How to know if its the same User?
I asked a question awhile ago asking how to make an efficient encrypted chatroom. What I ended up doing was Making each user generate a 4096 bit RSA KeyPair, share their public Keys, and then one of ...
3
votes
2answers
297 views
Implementing brute force attacks on hash values in Javascript
I'm working for my bachelor thesis at the end of which I aim to implement a proof-of-concept Javascript-based hash cracker. The idea is to work like this: Users can submit a hash value along with ...
3
votes
1answer
468 views
Bcrypt as a key derivation function?
I read a lot of entries at stack exchange about bcrypt and why it is supposed to be better than PBKDF2 in terms of password storage.
I'm asking now if bcrypt is better than PBKDF2 in terms of key ...
3
votes
2answers
474 views
BlackBerry client authenticating to Java Web Service
I already asked this question at StackOverflow here: http://stackoverflow.com/questions/4970681/blackberry-app-security and was directed to this site, can anyone pitch in as to how I can solve this ...
3
votes
2answers
401 views
Hashing Algorithms on GPU, 32 bit vs 64 bit
I read here in What algorithms are best be cracked by GPU? that, hashing algorithms such as SHA1, SHA224, SHA256 which do 32 bit integer arithmetic and logical operations are better implemented on GPU ...
3
votes
1answer
153 views
How to determine hashes/second in password cryptanalysis
I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt.
I'd like to ...
3
votes
2answers
269 views
File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?
I've been using this command to encrypt files for a while now:
openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc
Then I type in a password.
Can someone tell me, roughly speaking, ...
3
votes
1answer
148 views
DPAPI offline attack by cracking windows password?
I'm thinking of using DPAPI to protect configuration file information in my program. After doing some reading on it, it looks like it uses the user's Windows password as part of the encryption ...
3
votes
2answers
393 views
Security of GPG encryption with AES and MD5 if MD5 is broken
I have a file encrypted with gpg, using AES256 and MD5. Suppose that the MD5 hash function is broken, but not the AES cipher. Does that make it easy to crack decrypt the file?
3
votes
1answer
206 views
self-signatures using SHA1
This page says:
self-signatures must not use SHA1
You can check this by doing:
gpg --export-options export-minimal --export <keyid> | gpg --list-packets |grep -A 2 signature|grep ...
3
votes
1answer
89 views
Password hashing on a load balancing setup
I've been doing some research into password hashing implementations and would like to know if it's feasible to have two servers hash passwords to the same database?
I've come across the Bcrypt.net ...
3
votes
1answer
79 views
Are there any uses of having a non-deterministic salt value for hashes?
So I've been toying with the idea of having non-deterministic salt values for hashes.
Let me explain what I mean:
Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
3
votes
1answer
154 views
How should I store a password to allow people to enter single characters from it? [duplicate]
Possible Duplicate:
How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?
Some banking applications ask for random letters ...
3
votes
2answers
191 views
What algorithms can be used for device pairing?
I am to implement a system where android devices connect to a central server and have to register with different user accounts, so I have decided to create a pairing dance similar to what can be ...
3
votes
0answers
275 views
Can an attacker guess my password length from a hash? [duplicate]
Possible Duplicate:
Possible to detect password length from hash? Is doubling your password adds more security?
Considering I do not provide him any personal information relating to it, are ...
3
votes
0answers
183 views
Checking whether a password is derived from previous passwords [duplicate]
Possible Duplicate:
How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
On a system I used several years ...
3
votes
0answers
134 views
Files for download and their hash numbers
I'm far from being an expert in the IT security and I have this maybe naive question. Many downloadable files are deployed on websites together with the corresponding hash numbers to ensure their ...
2
votes
7answers
434 views
Is it possible to detect password length from hash? Does doubling your password add more security?
Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
2
votes
2answers
344 views
Why do most hashing functions produce hashes that have characters a-f 0-9?
This is something I never understood about hashing functions. I know that algorithms like whirlpool and blowfish both produce outputs that don't follow this pattern, but why is it that most do? Is ...
2
votes
6answers
277 views
Does shuffling a hashed password increase its security?
I am making a web app and I'm now stuck on making the login secure. I'm thinking of adding a salt to a user-inputted password and then hash it. (md5 or sha for example)
and then I will reshuffle the ...
2
votes
2answers
233 views
What is this hashing algorithm?
I need to authenticate against another programs user credentials to allow access to a second tie-in system. I am having trouble figuring out what hashing algorithm is being used by the first program ...
