A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

4
votes
2answers
910 views

How does processor architecture affect password hashing speed?

Does hashing speed vary significantly using different architectures (x86 vs ARM)? Scenario I am investigating the possibility of using a cluster of Raspberry Pi for cracking passwords hashed with ...
4
votes
6answers
1k views

Tracking unique web site visits without logging IP addresses

On Monday, some IP address xxx.xxx.xxx.xxx visits my site. I log it. On Tuesday, another IP address yyy.yyy.yyy.yyy visits my site. I log it. If the two IP addresses are equal, I throw out the ...
4
votes
3answers
1k views

symetric key encryption vs hashing

This is a fascinating document: top 100 passwords from adobe breach I have a question about one part of it: However, thanks to Adobe choosing symmetric key encryption over hashing, selecting ...
4
votes
3answers
164 views

Is it good practice to SHA512 passwords prior to passing them to bcrypt?

I want to allow any-sized passwords to be allowed to be submitted. I currently use bcrypt as a key derivation function for passwords, however I have realized that it has a maximum input length of 72. ...
4
votes
4answers
687 views

Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself? [duplicate]

I have moved this question from stackoverflow to this place. I know it may be a question about 'opinion' but I am not looking for a private opinion but a source of the final decision to keep it this ...
4
votes
5answers
621 views

When hashing passwords, is it okay to store the algorithm used right there in the database?

Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
4
votes
3answers
411 views

Hashed passwords - How many variations of rainbow tables?

First off...I passed the CISSP exam. WOOOO. I had to get that out. GCIH and CEH by Sept. 11' So, while studying for the technical side of things, I see that there are rainbow tables. They are ...
4
votes
2answers
618 views

What is the purpose of using Youtube-style alphanumeric ids as URL slugs?

I asked a question on StackOverflow on how to generate the alphanumeric/base64 resource IDs that Youtube, Instragram, and others use to identify videos/pictures/etc. Discussion led to the question of ...
4
votes
3answers
124 views

OS Kernel Hashing

Has anyone had experience with or is aware of any products that hash the OS kernel? This would be used, ideally, for watching for system compromises, auditing, change management, etc. I am looking ...
4
votes
2answers
602 views

Is it safe to use PBKDF2 for hashing?

I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
4
votes
4answers
415 views

User password as key instead of hashing it

I was reading here on Hashes and Salts and I thought about another method to do user authentication. I need your thoughts on this as I might be overlooking something. Scenario: For web application ...
4
votes
2answers
17k views

OpenSSH default/preferred ciphers, hash, etc for SSH2

When using OpenSSH server (sshd) and client (ssh), what are all of the default / program preferred ciphers, hash, etc. (security related) and their default options (such as key length)? So, what are ...
4
votes
3answers
507 views

Is there a hash algorithm that can identify similar files or strings?

Is there a hash algorithm that will help you identify similar files or strings? For example, the hash for ABC and XBC would be similar rather than radically different as is usually the case. I know of ...
4
votes
3answers
378 views

comparing password hashing algorithms - PoC ideas?

OK so I just started working for a security consulting firm and we recommend SHA 256 (with salt) for password hashing because MD5 is too weak. I have read some brilliant answers (the list is too ...
4
votes
5answers
492 views

Expanding/Inverse Hash function

First off, before I ask my question, let me explain what I am NOT asking. I am NOT asking for a way/method to reverse a hash output; by definition, a hashing function is one-way. Is there such a ...
4
votes
4answers
429 views

Hashing a key: less entropy than the key itself

A web API needs to store a 'key' for authentication, in much the same fashion as a password but at 128 characters. My concern is that the salted SHA1 hash for the key has less entropy than the key ...
4
votes
2answers
256 views

What steps can you take to make offline cracking of SRP harder?

In the aftermath of the Blizzard hack, what steps can I take to make offline cracking of SRP more difficult? My question assumes that your database is already gone and that you implemented SRP more ...
4
votes
5answers
514 views

Can hash functions be used with CTR or OFB mode?

I have been writing a class that encrypts and decrypts with block ciphers. I want to use Counter Mode(CTR/CM). We know that Counter Mode generates a keystream basing on counters, then XOR the ...
4
votes
4answers
1k views

Is encrypting a salt value with a password/plaintext a viable alternative to straight up hashing?

The basic problem, as far as I can tell, is that hashing's flaw is that the password is in the hash. Asymmetric encryption's flaw is that the password is encrypted and can be reversed. The posts ...
4
votes
2answers
2k views

openssl_digest vs hash vs hash_hmac? Difference between SALT & HMAC?

openssl_digest vs hash vs hash_hmac I want to use SHA512 for storing password. Which of the above methods are best to use? Why? What is the difference between SALT & HMAC? I just read ...
4
votes
5answers
507 views

What about combining pkdf2 with scrypt? [duplicate]

Possible Duplicate: Would it make sense to use Bcrypt and PBKDF2 together? How does the following password hashing scheme look to you? iterations1 = scrypt iterations required to spend ...
4
votes
1answer
828 views

Bcrypt as a key derivation function?

I read a lot of entries at stack exchange about bcrypt and why it is supposed to be better than PBKDF2 in terms of password storage. I'm asking now if bcrypt is better than PBKDF2 in terms of key ...
4
votes
1answer
108 views

Using random number to salt passwords

in a project I have, I'm salting passwords with 3 salts at the moment... Static salt - hard-coded into the source-code. Randomly generated salt (using a function designed for generating password ...
4
votes
1answer
213 views

How big is the risk of hash fixed points/cycles?

It's established wisdom to hash password multiple times with a salt to increase the time it takes per brute force iteration. At the same time (unless the algorithm guarantees otherwise) there's a ...
4
votes
1answer
3k views

Is BCrypt enough when saving a password into a database?

In order to allow users to connect to my website, I encrypt their password using BCrypt since it is one of the slowest algorithms to decrypt (making a compromised database longer to be decrypted). ...
4
votes
2answers
4k views

PHP Vulnerability May Halt Millions of Servers - max_input_vars!

Recent version of PHP 5.3.9 has been released a couple days ago, and Hash Collisions have been fixed, most of the servers actually didn't upgrade their server until now, including my website's server. ...
4
votes
1answer
76 views

Standards for CA cert revocation and time-constrained cryptographic algorithm parameters

I'm working on software that will be in use for foreseeable future (15 years+) that will need to validate XAdES-A signatures (long term archival, similar to PAdES-A, but for XML). That means, it will ...
4
votes
3answers
171 views

Why is password strength often underestimated and uncertain in the context of password hashing?

An aspect of security has bugged me for a long time: Why is there positive certainty about the importance of hashing algorithms and salts, but password strength is either never mentioned at all or ...
4
votes
1answer
3k views

Is PBKDF2 only SHA1 in C#?

I can't find a way of specifying the hashing algorithm used by the PBKDF2 (the Rfc2898DeriveBytes class) implementation in C# System.Security.Cryptography. It seems to be just SHA1. Am I missing ...
4
votes
1answer
2k views

Rainbow tables, generation and lookup, preferably using GPU

1a) What software can I use to generate my own rainbow tables, preferably software that can utilize CUDA or ATI Stream? One of the reasons I want to make my own, is that I want to use a specific ...
4
votes
1answer
66 views

Will my method for managing account data work?

I'm looking at whats nessecary to create a small accounts server for a video game I'm programming in my spare time. User privacy is a very important topic for me, and I don't want to keep anything ...
3
votes
7answers
1k views

Is it possible to detect password length from hash? Does doubling your password add more security?

Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
3
votes
4answers
435 views

How to tell if a site is securely storing passwords? [closed]

A site I frequent has a policy to make you change your password every 90 days. That's a cool policy, but I stumbled upon an old xkcd and facepalmed myself, because lots of doxing happens on this site. ...
3
votes
6answers
758 views

Is there a table that compares hashing algorithms by speed, relatively (machine independent)

As far as I understood*, one of the major criteria when choosing a password / salt hashing algorithm is it's speed. To prevent brute force attacks, a slower algorithm is better (and also makes it more ...
3
votes
3answers
658 views

Is this a secure way of storing passwords? [duplicate]

So a couple years ago when I was learning basic back-end web development, I found a tutorial for creating a basic log in system. I haven't done much modification to the code since, but I have the ...
3
votes
4answers
527 views

Irreversible hashing without collision

We are looking to allow users to log on with a smart card. The smart card reader can read the smart card ID and send it to us. We are, however, not allowed to store the smart card ID. Not in ...
3
votes
2answers
1k views

Why do most hashing functions produce hashes that have characters a-f 0-9?

This is something I never understood about hashing functions. I know that algorithms like whirlpool and blowfish both produce outputs that don't follow this pattern, but why is it that most do? Is ...
3
votes
3answers
178 views

SHA and “Bits of Security”

I've researched several forms of encryption/hashing and have often come across the term "bits of security". For example, at least one source claimed SHA-256 = AES128 = ECC256 = 128 bits of security. ...
3
votes
4answers
218 views

Are there any websites that gather hash sums of different disk image files?

For example the SHA256sum of an Ubuntu ISO image, or an OpenBSD amd64 image. Are there any sites? It's important that the site must use HTTPS or at least it must provide GPG check for the hashes.
3
votes
4answers
363 views

True?: “Nearly all encrypted passwords are stored with the last character in clear text”?

[S]ome passwords are gleaned by hacking into computers where intruders can find stored passwords. Those are stored in encrypted form, but there's software that can attack the encryption. Nearly ...
3
votes
5answers
299 views

Are hash functions “strongest link”?

It seems to me that if you were to use multiple hash functions, the "strongest link" would hold up the others. For example: HelloWorld --- md5 --> 68e109f0f40ca72a15e05cc22786f8e6 --- sha256 ...
3
votes
3answers
655 views

Hash Function Xor

For a hash function what is the best secure method, XOR or Concatenate: h(data1 XOR data2 XOR data3 XOR data4) ? or use h(data1||data2||data3||data4)?
3
votes
4answers
614 views

How to properly anonymize data, if hashing isn't enough?

Today there are news on Bruce Schneier's blog and ArsTechnica about how NY City released information about Cab/Taxi drivers, their trips, and so on. Basically, sensitive information was simply MD5 ...
3
votes
2answers
1k views

Is it a good idea to store Email addresses as hash only?

I am currently building a web service at http://write-math.com similar to http://detexify.kirelabs.org/ that should help users to get LaTeX code from drawn formulae. It is part of my bachelors thesis ...
3
votes
3answers
448 views

Why not hashing and salting passwords?

When I was implementing my webapp, I decided to hash and salt users' passwords in order to protect them, even though I knew that there will never be a lot of them ... if any. Of course, I'm not saying ...
3
votes
2answers
326 views

Is there any way to cryptographically hash a human thumbprint?

Is there any way to cryptographically hash a human thumbprint into a form that can be consistently reproduced by thumbprint readers? Assuming that it would be possible to create a database of ...
3
votes
2answers
419 views

Is mt_rand() suitable for generating a salt?

Assumed I have to following code in order to generate a random blowfish salt for saving a new password: $blowfishCharacters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./'; $salt ...
3
votes
2answers
754 views

Program binaries or files with same MD5 hash

I'm looking for 2 different program binaries or 2 different files with the same MD5 hash to prove its weakness and the collisions in the algorithm.
3
votes
3answers
2k views

Can the salt for PBKDF2 be a hash of the user-entered password?

I want to derive a key from a password in a client application that will be used as a master key that decrypts a data key. As far as I understand the salt should be private knowledge. Would it be ...
3
votes
2answers
313 views

MD5 display format

When I run MD5 algorithm I am getting an output in numeric and a few lower case letters. Obviously it uses all numeric digits and rarely i saw some lower case alphabet letter. I need to understand ...