Tagged Questions

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

0
votes
1answer
171 views

Windows 7 password recovery [duplicate]

A few weeks ago I've changed the password on my old laptop, I forgot the password as I wasn't using it often. Now I need to recover the password because I used it to encrypt some important documents. ...
0
votes
2answers
110 views

Password stretching using concatenation of hashes

I'm working on a simple file encryption tool. Basically, here's how my program works: password = get_user_typed_password() salt = uuid4() key = bcrypt(password + salt) cipher = AES(key) for block ...
2
votes
2answers
195 views

Does sending two different hashes of the same password reduce security?

I'm updating a login system. The password is sent to the server as SHA512(password + long_string). I want to switch this to something like SHA512(username + password) in the future. By doing that I ...
-1
votes
2answers
200 views

Is AES feasible for secure hashing files? [closed]

There was already a similar topic "Why AES is not used for secure hashing, instead of SHA-x?", but it was not about files specifically, and I, personally, am not convinced by the answers in it. "AES ...
1
vote
1answer
113 views

Sending Salts For Key Generation

I am working on a project that uses a combination of a web based framework (Django) and an installed app (Python) for the purpose of data entry/upload. I will have to send medical records over the web ...
0
votes
3answers
174 views

Hash algorithm without ASIC's

I want to design a new crypto-currency, with an algorithm which is different from SHA-256 or Scrypt. But in order to do this, I need to know the hash algorithm which is the hardest to make ...
1
vote
0answers
76 views

Login details security using salt n hash and a login role in postgresql

I am coding up the security for a website in express.js and postgresql db. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but my ...
1
vote
1answer
70 views

Am I right by changing the default algorithm on a web app?

Numerous clients have told me that my suggestion on changing the algorithm on a web app does not increase security. I've tried reasoning that if the files have not been exposed, the attacker has to ...
0
votes
2answers
803 views

What is the advantage of using a symmetric cipher like AES to generate a keystream?

I see examples of AES (with a shared secret key) being used to encrypt shared secrets (e.g. nonce + counter) to produce a keystream against which the plaintext is XOR'ed to produce the ciphertext. ...
1
vote
2answers
440 views

Should I decode a base64 password before hashing for storage?

My server gets base64 encoded passwords from the client, and I am going to hash them for storage in a credentials table. Should I decode the password and hash the clear text password, or just hash ...
0
votes
1answer
89 views

Using multiple hash-functions along the line [duplicate]

I was wondering what the effect on strength/security is If I would use an aggregate of multiple hash-functions. For instance, I don't want to sent passwords in plain text (although it's over an ...
3
votes
2answers
360 views

How can I store a password history to prevent reuse?

I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt. How can I implement a password history set (to prevent password reuse) in a ...
-3
votes
1answer
96 views

What is this encrypted with or where can I find examples of encryptions to compare it with? [closed]

I have a hash thingy I am trying to decode and I have done relatively little with encryption, though I would like to try to learn some more. The hash is: 1YMTpavsFq7ykllC3CCsg3e1li31re1nROxuW1wqIqpk ...
1
vote
0answers
24 views

How is password character validation in 3D secure is implemented? [duplicate]

We have a website which stores hashed passwords in the database. During logins we hash the password entered by user and compare two hashes. This is quite standard so far. Our client which is in ...
4
votes
2answers
678 views

Is it safe to use PBKDF2 for hashing?

I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
5
votes
1answer
732 views

Is every hash format that nginx accepts for HTTP Basic Auth weak against brute force?

According to http://nginx.org/en/docs/http/ngx_http_auth_basic_module.html nginx can read password hashes of these types: crypt(), apr1, SHA1 & SSHA. This is how I understand how these hashes ...
3
votes
2answers
154 views

Using public key infrastructure or hashing for personal identification privacy?

I've been reading about identity theft recently, and I'm wondering about some possible solutions using the techniques of asymmetric/symmetric/hashing in encryption. My idea is going to cross those 3 ...
4
votes
3answers
496 views

Why not hashing and salting passwords?

When I was implementing my webapp, I decided to hash and salt users' passwords in order to protect them, even though I knew that there will never be a lot of them ... if any. Of course, I'm not saying ...
0
votes
1answer
125 views

Is it a good idea to hash a string and use it as a passphrase?

Is it a good idea to hash(SHA-512/whirlpool) some simple memorable string and use it for passphrase(for LUKS/TrueCrypt container), instead of using just a string like t4k#La93Fs(5w5) as a passphrase?
3
votes
2answers
223 views

Rainbow Tables: What is the Reduction Used for?

This is a follow up from this answer. The answer is very good, and it put me to thinking and doing some research. I have found another good explanation on this site. At some point, the author says: ...
0
votes
1answer
141 views

Rainbowtable - Start with plain text [duplicate]

I know how to use rainbow tables. I've already read the other questions this topic here. Well but there is still one question left. As an attacker, I usually have a hash value of a password and ...
3
votes
1answer
159 views

using counter instead of salt for hashing

I'm developing own protocol for secure message exchanging. Each message contains the following fields: HMAC, time, salt, and message itself. HMAC is computed over all other fields using known secret ...
0
votes
0answers
65 views

Does the ordering of encryption and hashing matter? [duplicate]

I am now learning keyed hash function, where A and B share a secret key k. I want to know if the ordering of encryption E and hashing H matters? i.e. Is there any difference between H ◦ Ek (m) and Ek ...
-1
votes
1answer
119 views

Password sending through network [duplicate]

In case of no TLS/SSL available, why can't I use the hash of the password (SHA512) as the key to encrypt the password (with out any salt) to send through the network ? MITM attacks I can understand, ...
3
votes
4answers
542 views

Irreversible hashing without collision

We are looking to allow users to log on with a smart card. The smart card reader can read the smart card ID and send it to us. We are, however, not allowed to store the smart card ID. Not in ...
4
votes
5answers
602 views

Use the hash of the password to encrypted password

I have a app which transmit the password in clear text. I was planning to use the hash of the password (SHA-512) as the key for encrypting the plain text password. Then send the encrypted text to the ...
7
votes
1answer
592 views

Does bcrypt on top of md5 reduce its security?

A GitHub project I recently checked has a flawed security as they're using an unsalted md5() to hash the passwords. I opened a bug and they acknowledged it. However, the transition from md5() to ...
2
votes
0answers
246 views

How do I convert from this weird John/Asleap format to lc (for HashCat)?

I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
1
vote
2answers
210 views

How secure are hashed passwords that are salted too?

SAP Netweaver has its passwords hashed and also salted. But I read that a tool such as John the Ripper can bruteforce them. So how does security varies when passwords are hashed, in particular in the ...
4
votes
4answers
400 views

usernames and passwords

I was thinking about usernames and passwords and I was wondering how secure it would be to instead of the server having a list of usernames and accompanying hash of the passwords, just have a list of ...
1
vote
1answer
276 views

What key to use in HMAC

I need to use HMAC on a certain message to guarantee integrity, but I cannot figure out what are the requirements for the key to be given as input to the hashing algorithm. In particular I have to ...
7
votes
6answers
847 views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
4
votes
3answers
1k views

symetric key encryption vs hashing

This is a fascinating document: top 100 passwords from adobe breach I have a question about one part of it: However, thanks to Adobe choosing symmetric key encryption over hashing, selecting ...
2
votes
1answer
85 views

MITM vs. data leakage

We are designing a web API - accessible via https only - but two schools of thought seem to have arisen among our team: Group 1 wants to adopt an approach that is more concerned about data leakage ...
3
votes
4answers
454 views

How to tell if a site is securely storing passwords? [closed]

A site I frequent has a policy to make you change your password every 90 days. That's a cool policy, but I stumbled upon an old xkcd and facepalmed myself, because lots of doxing happens on this site. ...
4
votes
3answers
539 views

Is there a hash algorithm that can identify similar files or strings?

Is there a hash algorithm that will help you identify similar files or strings? For example, the hash for ABC and XBC would be similar rather than radically different as is usually the case. I know of ...
1
vote
1answer
585 views

Reversing a block hash of SHA-1 with known Plaintext?

Is it possible to reverse the hashing of a block in a Datastream fed to an SHA1 if the plaintext for that block is known? If it is not possible (which I assume) does it make attacks to retrieve the ...
1
vote
3answers
296 views

Brute Force In Order Or Random?

Which is faster, on average to find the original plain text of a hash: brute force in-order, or with random plaintexts?
0
votes
2answers
281 views

scrypt strength with “weak” salt

I'm working on a project where following constrains apply: There's no remote database or any other means of storing extra data like random salt When user logins in, only username and password are ...
8
votes
4answers
686 views

At what point does adding more iterations to PBKDF2 provide no extra security?

If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an ...
3
votes
1answer
1k views

Are there sha 512 rainbow tables available? [closed]

Are there sha 512 rainbow tables available for download or what kind of dimensions and processing power would be required to generate them?
3
votes
1answer
695 views

Reverse-engineering password salts

Lets set out a scenario, a database has been dumped and all the passwords are hashed. You notice that some users seemed to have signed up twice and have the same hash. You run these hashes through ...
0
votes
1answer
73 views

Payload authentication + HW-SW Binding

I want to authenticate a (2nd stage) bootloader during the boot process using a symmetric key, which is derived from HW properties of the platform the bootloader is running on. Thus, I want to bind ...
1
vote
1answer
510 views

Is this password hashing + salt method the most secure way possible? [duplicate]

I am just wondering what all the security experts think of my method for password hashing. I want to come up with a method I can use for all my future web development projects. First I create a ...
5
votes
3answers
394 views

comparing password hashing algorithms - PoC ideas?

OK so I just started working for a security consulting firm and we recommend SHA 256 (with salt) for password hashing because MD5 is too weak. I have read some brilliant answers (the list is too ...
1
vote
2answers
173 views

Would multiple exposed bcrypt hashes of the same UUID v4 with random generated salt be too insecure?

I'm looking into implementing an ownership check on JSON objects and want to avoid going back to the database to ensure ownership of said object/record (i.e., to prevent a user from updating an ...
0
votes
2answers
516 views

Does using Bcrypt to encrypt credit card numbers satisfy PCI compliance?

I understand that using MD5 is not safe and is not PCI compliant. Does using BCrypt satisfy PCI compliance
9
votes
4answers
547 views

How can I be secure with a global salt?

If I understood the basic of password hashing and storing, what we need are: a "strong" salt a "real" random salt a unique salt per password a password hashing function with a high CPU cost We ...
1
vote
1answer
2k views

Brute force password cracking with a GPU

How are GPU's provisioned for password cracking? Do all, if not most cracking programs have special GPU aware software or do they just function at the basic driver or API level of the device? Can it ...
1
vote
2answers
1k views

How can I check the integrity of the downloaded files?

I know we use hash functions to check for the integrity of the files etc... but my question is how can we check for the integrity of the files being downloaded from some server?