A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

0
votes
1answer
12 views

Securing FTP Creds in a Java Open Source API

I've written a basic Java API and source code must be released to a small community for the application to function correctly. The Java API helps developers track data for their running scripts and ...
0
votes
1answer
59 views

Possible to take hash from know result and algorithm?

I am trying to build a casino site in PHP where users can play roulette. I found this algorithm that I want to use to "roll" numbers: <?php $secret = ...
0
votes
2answers
105 views

store passwords as one-way-hash, or just use it as an AES key?

I want to store some data so the only one who'll be able to access it is the user itself. Here is my idea: when user registers, his password will be hashed in SHA256 (so it'll fit as an AES key), and ...
17
votes
2answers
2k views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
-1
votes
1answer
473 views

SQLMAP --OS-SHELL error [closed]

root@kali:~# sqlmap -u http://www.a***********.com/info.php?id=2 --os-shell _ _ _| |_____ _ {1.0-dev-nongit-20150907} | -| . | | | .'| . | || |||||,| | || |_| ...
14
votes
6answers
8k views

Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() “better” for Unicode Password hashing than traditional methods?

When is it appropriate to use RFC2898DeriveBytes versus a typical hash? Update I now understand that a KDF is typically used to create a symmetric key for possible use in encrypting a stream. I ...
1
vote
0answers
70 views

How to implement iterations when hashing passwords?

To securely hash passwords, algorithms such as PBKDF2 do many iterations of a common hash such as SHA1. Are there certain ways that these iterations need to be done to be safe? In particular, from ...
-4
votes
0answers
51 views

How does server process validates the credentials supplied by client in basic authentication [closed]

I am clear at high level what is happening in basic authentication. the portion what I am missing is, soon after server process receives windows account credentials from client, how does it validate ...
1
vote
0answers
17 views

How do atom's apm and npm verify package integrity?

Are there built in verification methods to make sure the packages contain the correct code? Do they use a hash of some sort?
1
vote
1answer
75 views

How does JDBC send passwords to the server?

I am really curious about how JDBC sends passwords to the server. While I understand that is simply an API and it depends on the implementation, are they usually hashed and then sent to server? If I ...
1
vote
3answers
236 views

About SHA1 in default Disk Encryption in Linux

Link to the Thread: Recommended options for LUKS (cryptsetup) I wonder what's the exact difference between SHA1 and SHA512. I know that SHA512 has a longer key but I've read that it doesn't matter ...
5
votes
3answers
212 views

How to check if your Android app was updated by MitM?

As I was browsing on my phone yesterday, a gray popup appeared on my screen just as I was swiping up, and I accidentally hit the accept button. In the fraction of a second it was on I was able to read ...
1
vote
1answer
98 views

PHP BLENC extension security concern

PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
1
vote
1answer
29 views

Possible number of collisions in a hashing function with constant message size

Jumping to conclusions from my question, can we predict possible number of collisions for a given message in a given hashing algorithm. Say I am using SHA-1 which outputs 160 characters string, and ...
-1
votes
1answer
57 views

Shouldn't multiple images always exist even in most powerful hashing algorithm?

I have a confusion in mind that since in hashing we transform a large string into a smaller fixed size string, so its unlikely that any large string has a unique hash. There had to be collisions and ...
49
votes
4answers
111k views

Is SHA1 better than md5 only because it generates a hash of 160 bits?

It is well known that SHA1 is recommended more than md5 for hashing since md5 is practically broken as lot of collisions have been found. With the birthday attack, it is possible to get a collision ...
2
votes
0answers
29 views

How exactly does “Apache Shiro's” hashing work when using a Desktop-Client

I was looking at this question How does storing hash passwords work? and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. ...
13
votes
1answer
3k views

Should I hash my passwords even if I am only allowed to generate limited traffic?

At this moment I'm busy working on an webapp with a friend of mine. The main problem we have is that we are only allowed to generate 50 GB a month in datatraffic. My question is: Does hashing the ...
-5
votes
1answer
73 views

Time to break SHA-512 [closed]

From http://stackoverflow.com/questions/6776050/how-long-to-brute-force-a-salted-sha-512-hash-salt-provided, to break SHA-512 with brute force strategy, it require 3,17 * 10^64 years. It is almost ...
0
votes
1answer
85 views

How many hashes do I need to compute to get x collisions?

I know that you need to hash about 2^(N/2) to find a collision taking into account the birthday problem. But I'm not really sure about more than one collision, I mean, collisions with different ...
17
votes
8answers
4k views

Won't all hashes collide after enough iterations with a static salt?

We all know that we're supposed to take a fairly slow hashing algorithm, salt the password, and run the hash for many iterations. Let's say that I'm following almost everything except for one rule, ...
42
votes
4answers
31k views

Are salted SHA-256/512 hashes still safe if the hashes and their salts are exposed?

Scenario: a database of hashed and and salted passwords, including salts for each password, is stolen by a malicious user. Passwords are 6-10 chars long and chosen by non-technical users. Can this ...
1
vote
2answers
415 views

How to store the access token / password reset token in the database?

I have an access code that is sent to users so that they can access the site in one-click. From terms of access it's very similar to the password reset url, so I assume the same assumptions apply. ...
1
vote
1answer
129 views

How can one securely hash passwords server side while avoiding DoS?

It is generally recommended that one use a slow hash function to hash passwords. However, does this create a DoS risk?
4
votes
1answer
134 views

Is the 64-bits length of the original string padded as well in the MD5 hashfunction?

So, for example I have a string which binary value is exactly 512 - 64 bits long, so the binary conversion of the string does not have to be padded. So that means I have a string of 56 chars. The ...
14
votes
2answers
1k views

What's the difference between a hashed and an encrypted password?

Alright, so I know this may sound dumb, but I'm having a hard time understanding what an encryption would be since it's different from a hash. I've read up on it, but I'm still not quite sure. So, I ...
34
votes
8answers
4k views

Find matching phone numbers without actually knowing them

We have a mobile app that, given two users, needs to let them see what common contacts they have based on their phone numbers. How can we do this in a cryptographically secure way and respecting the ...
6
votes
2answers
805 views

Is it safe to publish something encrypted with a password if you make it insanely difficult to crack?

Let's say you have a very important private key that you don't want to lose. You think of posting it to http://pastebin.com/ but then relize that elimanates the point. So you think of encrypting with ...
9
votes
6answers
1k views

Does repeating one word to form a password result in a similar pattern in its encrypted format?

If i use a single word to form a password by repeating it like the examples below: securesecuresecuresecuresecuresecure SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe ...
0
votes
2answers
94 views

How do data breaches of account login information end up in plaintext?

For example, see this story. Am I missing something here? Are the login details actually still encrypted? I don't understand how it is possible for a data breach of what I assume is encrypted ...
3
votes
2answers
69 views

For high entropy credentials, is SHA256 hashing good enough?

Let's say I've got a database of high-entropy credentials (e.g. 256-bit random values) used as API keys by clients. I'd like to hash them in my database so that a database compromise doesn't allow an ...
1
vote
1answer
49 views

Value of hash in digital signature

I'm hashing using SHA 256 and signing a payload with a private key.The payload does not contain any password and would be HTTP(S) POSTed to server side. The payload contains some dynamic and constant ...
1
vote
0answers
30 views

Change NTLM hash in memory on the lock screen?

Is there a way to change the ntlm hash in memory to bypass Windows login? For example, I have the NTLM hash of a Windows machine and I have physical access. Is possible to write the NTLM hash in ...
2
votes
1answer
214 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
0
votes
2answers
45 views

How to properly hash a key? big vs small digest

We have to roll (decommission) database access keys often, but it's important to know which key each system is using in order to avoid removing a key in use thus creating unavailability. We want each ...
1
vote
0answers
52 views

Which is the correct algorithm while checksumming a portion of code?

As part of my research, I came across a technique in a paper which applies checksumming on a portion of code. I want to implement it. Here is the research paper which talks about the checksumming ...
2
votes
1answer
106 views

What is the difference between a digital signature and whole message encryption?

I am newbie in information security I am trying to understand the difference between a digital signature and encryption of a message. Lets consider simple example of email message. I understand how ...
0
votes
0answers
4 views

What are the advatages or disadvatages of using seperate chaining over linear or quadratic probing? [migrated]

I was looking through different hash methods the other day and was curious as to what the advantages or disadvantages of using separate chaining over linear or quadratic probing. I know that with ...
4
votes
1answer
249 views

OpenSSL 0.9.6a PRNG algorithm weakness: How to exploit?

I saw an OpenSSL security advisory for Openssl 0.9.6a Recently a cryptographic flaw in OpenSSL's built-in pseudo-random number generator (PRNG) was pointed out to us by Markku-Juhani O. Saarinen ...
4
votes
0answers
84 views

What are the recommended scrypt cost factors for 2016?

I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?
0
votes
1answer
75 views

Is `/dev/urandom` secure to generate a salt on a Virtual Machine?

I've read the new password_hash() function from PHP uses /dev/urandom to generate a secure salt, however this assumes some noise from device drivers. Is possible that /dev/urandom is not so random ...
13
votes
2answers
2k views

Are SHA-2 certificates considered obsolete, or current?

A guide on this site on how to make a decent Certificate Signing Request (CSR) says that I should be using SHA-2 certificates to secure a HTTPS webserver. Are SHA-2 certificates considered obsolete, ...
6
votes
4answers
1k views

Does quick denial tell that you passwords are stored in plain text?

Say you are using a website and incorrectly enter your password. The website then "instantly" pops ups with an "incorrect username/password" message. Would it be safe to infer that the website is ...
1
vote
1answer
53 views

Powershell and cached credentials

In my environment we have powershell remoting off- I get around this using 2 hop scripts, packages(exe -no creds are stored in code- local privs only), and iwmi. I never pass creds to the endpoint, ...
0
votes
1answer
25 views

Hashing and signing partial data in payload

I'm hashing and signing part of a payload prior to HTTP Posting from a mobile device to server side. The payload contains of about 7 data elements and only 3 of them are hashed/signed using a private ...
3
votes
1answer
121 views

How to detect mimikatz usage on LAN

My boss is has made it clear that we need better ways of detecting mimikatz usage on the network- and I would agree. In place already for detection is suricata/ET PRO rule set on a couple of taps. ...
10
votes
2answers
949 views

Is there more to password hashing?

You have a plain text password and salt. The plain text password is assumed to be securely random and only known by the user and the salt is no secret and not necessarily unique but stored alongside ...
3
votes
1answer
155 views

Best way to hash passwords in PHP 5.3.5

What is the best way to hash passwords in PHP 5.3.5? Since in this version doesn't have password_hash().
1
vote
1answer
49 views

Is the method of hardening the creation of a Cryptographically Generated Address (CGA) called hash extension

CGAs are sha1 hashes truncated to a 59 bit value. Along with a 3 bit security parameter they form a IPv6 address (more precisely the interface identifier). from wikipedia: The Sec parameter ...
1
vote
2answers
74 views

Is it possible to find the salt?

I have this PHP code with me : $auth = md5($username.$password.$salt); I have a dummy value : $username = user $password = password And I also have the resulting MD5 Hash : ...