A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
2
votes
6answers
604 views
“Double hashing” with 2 different hash functions
Is doing something like this
sha256(sha512(password+salt))
Less secure then just doing
sha256(password+salt)
I've heard it will increase collision chances.
I can think of 3 reasons to do this
...
2
votes
3answers
770 views
what is the fastest and cheapest way to crack this kind of hash - md5(md5($password) + salt))?
I'm looking for a program that can use any GPU (ATI\NVIDIA) and can brute force a vBulletin hash - md5(md5($password) + salt)).
I have the salt and hash.
the password contains the symbols - ...
2
votes
4answers
170 views
When salting and hashing passwords, any advantage to including password length?
In this answer, Gilles says (emphasis mine):
There's no need to hide the salt from the attacker: it needs to be unique (and not derived from the password) but it doesn't need to be more secret ...
2
votes
3answers
194 views
Client-Side Hashing to decrease value of password guessing heuristics
Yes, this is 'yet another client-side hashing' question. But, don't leave yet, I think there is some value here.
I'd like to do something to mitigate the affect on the community as a whole when my ...
2
votes
3answers
154 views
Why we use GPG signatures for file verification instead of hash values?
for example here they put a gpg signature to verify what you download is what they really made. but why they just don't put a SHA256 hash value ? because its much more faster to check it and sometimes ...
2
votes
2answers
260 views
Why doesn't Microsoft implement salt on users passwords in Windows?
Pretty straightforward - So we use rainbow tables to get passwords of users out of hashes. So why won't Microsoft implement salt on the passwords in Windows to be hash(password+salt)?
Won't this ...
2
votes
1answer
461 views
Clarification on how rainbow tables work
If you goto : http://www.hanewin.net/encrypt/aes/aes-test.htm
for "Key in Hex" enter
00000000000000000000000000000056
for "Plaintext in Hex" enter
00000000000000000000000000000000
and click on ...
2
votes
7answers
472 views
Tracking unique web site visits without logging IP addresses
On Monday, some IP address xxx.xxx.xxx.xxx visits my site. I log it.
On Tuesday, another IP address yyy.yyy.yyy.yyy visits my site. I log it.
If the two IP addresses are equal, I throw out the ...
2
votes
1answer
185 views
How do we encrypt a password using another password?
Heys all I've got a nub question, I was wondering
What does it mean to encrypt a password using another password?
For example I want to encrypt a password foo using a password bar, does it mean that ...
2
votes
3answers
193 views
Identify client based on computed hash
I'm currently developing a web application which will serve data to iPhone clients.
In order to be the owner of the data, I don't want other clients to be able to get it.
I thought I could use a ...
2
votes
1answer
119 views
Can a salted hash be an effective MAC?
An HMAC is basically a "keyed hash". Only the correct message and the correct key will produce a particular hash digest efficiently.
Conceptually speaking, the same can be said for a salted hash; ...
2
votes
2answers
98 views
What's the point of using multiple checksum algorithm with “aide”?
In aide the author offers more than one hash algorithm to do the check-sum, why is that?
Aren't a single one, i.e sha512 enough for determining file changes? I believe these algorithms are all ...
2
votes
6answers
191 views
Is it okay to wrap a cryptographic hash with MD5 for storage?
Is there any security issues if you wrap your cryptographic hash with MD5 for storage purposes?
For example:
$hash = md5(hash($password,$salt,$rounds));
Note: hash() uses scrypt or bcrypt or pbkdf2 ...
2
votes
1answer
180 views
PCI-DSS and salt storage
PCI-DSS states the following:
3.5 Protect any keys used to secure cardholder data against disclosure and misuse
I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...
2
votes
1answer
141 views
Improving Digest Authentication using PBKDF2
For a variety of reasons, I need to use digest authentication for a REST server that I have created.
I have come up with an "improvement" that I believe strengthens the algorithm against MD5 attacks ...
2
votes
2answers
167 views
In this example why do they hash a randomly generated piece of salt before hashing it with the password?
From here, in the code return substr(sha1(mt_rand()),0,22); what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append ...
2
votes
5answers
164 views
Is there value in storing passwords in their own table with encrypted or hashed keys?
The usual method for simple sites is to store a hash of a user's password right in their user record.
What if the password field is removed from the user table, and a password table is created? The ...
2
votes
3answers
356 views
rsa encrypted hash == rsa signature
$ echo -n "1327943823" > test_ok.txt
$ openssl dgst -sha1 -binary -out test_ok.sha1 test_ok.txt
$ echo "GURbsl4CFPCG83RCZxsEpoRleXicXQhH1OC4Fk77b7EMj2g8aHUhD/L+sm
...
2
votes
2answers
609 views
Should we start using SHA-3? [duplicate]
Possible Duplicate:
What is SHA-3 and why did we change it?
SHA-3 has been finalized! So, what does secuirty.se think about the new hash funciton? Should we start replacing all uses of ...
2
votes
4answers
304 views
Hash/Digest of string; multiple clients and reverse lookup must be impossible
Ok so i need a technique (could be a system or just an algorithm) to generate a hash/digest of a string on a client app without me (admin of a server app) being able to determine what the original ...
2
votes
1answer
43 views
“Official statement” on php.net : CRYPT_BLOWFISH is strongest hash algorithm. Why?
First: I asked this question on stackoverflow and was kindly asked to post this here again. See the original question here.
According to the [early] doc pages of the new PHP 5.5 password ...
2
votes
1answer
135 views
What is the collision chance of a 128-bit hashing function if it is always fed with 256-bits of data?
I mean "normal" collisions not based on any attack.
How do i calculate it?
2
votes
2answers
708 views
OpenSSH default/preferred ciphers, hash, etc for SSH2
When using OpenSSH server (sshd) and client (ssh), what are all of the default / program preferred ciphers, hash, etc. (security related) and their default options (such as key length)?
So, what are ...
2
votes
1answer
172 views
Is there a better way to take advantage of current 'approved', 'proven', and memory/cpu-expensive algorithms while using salts and peppers?
I've read about the concepts presented in these two questions:
Pre-hash password before applying bcrypt to avoid restricting password length
Would it make sense to use Bcrypt and PBKDF2 together?
I ...
2
votes
1answer
89 views
What is the meaning of 'adaptative' and 'over time it can be made slower' in the context of the bcrypt algorithm?
I'm reading the wikipedia definition about bcrypt but I don't understand the meaning of 'adaptative' and 'over time it can be made slower'. Can someone explain what they mean in this situation?
2
votes
1answer
1k views
Is BCrypt enough when saving a password into a database?
In order to allow users to connect to my website, I encrypt their password using BCrypt since it is one of the slowest algorithms to decrypt (making a compromised database longer to be decrypted).
...
2
votes
1answer
62 views
Hash extension(padding) attack
I recently came across this website talking about sha1 padding attack.
http://www.vnsecurity.net/2010/03/codegate_challenge15_sha1_padding_attack/
After reading here are some of my doubts:
How ...
2
votes
1answer
159 views
Password authentication using DynamoDB
I'm working on a Mac app. I have users stored using DynamoDB.
Authentication is needed to enforce access control on system-internal operations, such as uploading files to Amazon S3. Of course, I ...
2
votes
1answer
107 views
Security of re-encryption with a list of pre-computed password based keys
I have a problem where an encrypted file stored on a server needs to be decrypted through a precomputed list of passwords that are used one time only - OTP applied to encryption basically. The file is ...
2
votes
3answers
346 views
Proper hash_hmac key creation
I'm looking for, but unable to find, some definitive information on how long to make the secret and what characters are useable in creating a HMAC signature in PHP using SHA256.
I found some ...
2
votes
4answers
250 views
Fingerprinting Hash Function
For the purpose of fingerprinting data with the least chance of collision will combining the length (as a 32 bit unsigned integer stored in addition to the hash) of the input data and/or sampling a ...
2
votes
2answers
314 views
Do OpenPGP/GnuPG apply slow hash to password when encrypting/decrypting key?
Password space is quiet small. Therefore slow hash should be applied to password before using it for encryption.
Should slow hash function (like bcrypt) be applied to password before using it with ...
2
votes
2answers
341 views
Time needed to generate an RSA signature of a document
How does the length of the RSA key and the size of the document affect the time it takes to sign a document using SHA-1 and RSA?
I used CrypTool to check it, but the time does not appear to be larger ...
2
votes
1answer
240 views
Cookie based session variables
I have a situation in which I cannot use a server-side session, but must allow users to log in, and for their logged in state to be persistent between queries.
As with anything that involves crypto ...
2
votes
1answer
87 views
Securely store two values per user in SQL
I have come across the need in my web app to store two values for each user. These values would need to be retrievable from a value stored in a URL. I would prefer to store neither of the values in ...
2
votes
1answer
123 views
Legality and ethics of cryptanalysis on password hashes
I'm working on my dissertation concerning cryptanalysis on password hashes. I'd like to delve into the legal and ethical aspects of cryptanalysis, however, seeing as I'n not at all well versed in law ...
2
votes
1answer
50 views
What is the purpose of the hashcode used in Exchange OWA HTTP requests?
This blog describes the URLs that are used in OWA and webservices. It also says that there is a hashcode that is used in conjunction with the throttling policy.
Is this hashcode responsible for ...
2
votes
1answer
323 views
Using John the Ripper to crack SHA hash w/ partial knowledge
Group, I have a SHA1 hash that I would like to brute-force. I have knowledge of several characters before and after the password (ie, if the hash is derived from "xxxpasswordyyy", I know both xxx and ...
2
votes
1answer
180 views
sha-512 vs sha-3? [duplicate]
Does the new SHA-3 Keccak hashing algorithm offer any benefits from SHA-512?
"Even worse, none of the SHA-3 candidates is significantly better. When SHA-3 is announced, I'm going to recommend that, ...
2
votes
1answer
167 views
Loki How to crack the password hash OSPF?
I have created for myself a lab of routers in GNS3 . Routing protocol between routers is OSPF.
Now,by Loki penetration testing, I found that routers are the feature authentication.
Using wireshark, I ...
2
votes
1answer
1k views
Is PBKDF2 only SHA1 in C#?
I can't find a way of specifying the hashing algorithm used by the PBKDF2 (the Rfc2898DeriveBytes class) implementation in C# System.Security.Cryptography.
It seems to be just SHA1. Am I missing ...
2
votes
3answers
862 views
When to use the different types of Encryption / hash algorithm?
I'm studying for CISSP and know they will ask what type of encryption to use in different situations. Does such a list exist or is there a general rule of thumb to use?
2
votes
2answers
34 views
Does glibc2 version of the crypt function still use DES for alternative hashing methods?
I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
2
votes
0answers
55 views
Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash? [migrated]
H(s,r)=d is a function that hashes the string s with a salt r, giving the result d.
Hashing functions are not injective, so there isn't a reverse function H'(d,r)=s.
Therefore to prove that d is a ...
2
votes
1answer
100 views
Seeding GPG keygen with a hashed secret [duplicate]
Possible Duplicate:
Tool for public key cryptography where password is the private key?
I was wondering if you guys could clue me in to potential problems with using a hashed password as ...
2
votes
3answers
185 views
Password Security: Encrypting salt [duplicate]
Possible Duplicate:
Password Hashing add salt + pepper or is salt enough?
I'm new to security and trying to understand why encrypting or hiding a salt is not considered useful. I've read ...
1
vote
4answers
274 views
Are there vunerabilities with this authentication mechanism?
I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire.
I was ...
1
vote
1answer
201 views
Use brute force to mitigate brute force
Just an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information.
My idea is this...
When storing a password in ...
1
vote
4answers
354 views
Antivirus Engine based MD5 or SHA1 hash?
I'm trying to understand more about MD5 and SHA1 hashes algorithms and their behavior in serious security software(found this but not helped me more).
Why does ClamAV use additional scanning ...
1
vote
4answers
167 views
Is it possible to know the key if we have the original value and the hash using HmacSHA1?
I was wondering if it were possible to know the key if you already know the original value and the hashed result.
For example, let's say :
`$value` = helloworld
`$hmac_key` = 0123456789
`$result` = ...
