A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

-3
votes
2answers
66 views

If I were to perform a MD5 hash every microsecond from 1-1-1970 how many hash colisions would I have [on hold]

I mean with a standard length of 32 you are doomed to have some hash collision, I ask this question just out of curiosity. I havent put a supercomputer or a timemachine just yet.
2
votes
2answers
586 views

Decoding SHA-512 value

How does the SHA-512 decoder on the following page work? http://md5hashing.net/hashing/sha512#main Hash values supposed to be unable to reverse. Is this page fake?
5
votes
1answer
53 views

How does combining SHA256 with RIPE-MD160 compare to SHA256 + SHA-3?

Bitcoin stores its addresses as a combined SHA256 + RIPE-MD160 hash. Is it correct to assume this is done to prevent a failure in the algorithm? Since SHA3 was designed to be an alternative to ...
3
votes
5answers
207 views

A secure way to encrypt a connection between 2 clients securing against both passive and active adversaries

Recently I got interested in encryption and the methods behind them. So for a fun / school project I am building a program in python to encrypt data between two clients (chat and files). I'm just ...
2
votes
0answers
22 views

How does SHA3 (Keccak & SHAKE) compare to SHA2? Should I use non-SHAKE parameters?

Keccak is the winner of the SHA3 competition. Since Keccak is highly customizable (presumably for security/memory/time/speed tradeoffs) there does seem to be some controversy around how Keccak ...
2
votes
1answer
54 views

Hashing algorithm for cryptsetup

I will encrypt my SSD using cryptsetup and I would like to know which hashing algprithm to use. First of all, cryptsetup benchmark: PBKDF2-sha256 262144 iterations per second PBKDF2-sha512 ...
2
votes
1answer
58 views

Securely storing passwords using PHP5

Starting note: After going through some articles and answers posted on SO related to storing secured passwords I'm still not sure whether my way of thinking is applicable to todays reality. I'm ...
1
vote
2answers
55 views

Salt addition in hashing? [duplicate]

I may be wrong here but reading about salt I was wondering whether if we use the same salt for every password saved in our database won't users having same password would lead to same hash even after ...
30
votes
5answers
6k views

If a web site shows me what my password was changed to, is it stored as plain text?

I just changed the password on a school-related web site. After completing the change successfully, the next page showed what the password was changed to. Can I conclude from this that the password ...
0
votes
1answer
62 views

How does PHP's password_hash() BCRYPT cost factor translate into cracking computation times

I am trying to fully understand the relationship between BCRYPT's COST factors and how much more time it would take a machine to crack a password with PHP 5.5's password_hash() The encryption times I ...
0
votes
0answers
9 views

Does a static salt in addition to a random one add any security? [duplicate]

I'm looking through some old hashing code and found something that made me raise an eyebrow. In order to store passwords, it uses BCrypt to generate a random salt and hash the password. Before that, ...
22
votes
11answers
3k views

Can a file contain its md5sum inside it?

Just wondering if it is possible to create a file which has its md5sum inside it along with other contents too.
5
votes
2answers
104 views

which memory hard hashing algorithm can equalize low-computational and high-computational power devices to utilize blockchain in the IoT?

Recently IBM and Microsoft showed their interest (IBM post, Microsoft post) in utilizing bitcoin's blockchain for internet of things (IoT) development. Let's assume that in close future the blockchain ...
-1
votes
2answers
89 views

SHA256 to text or MD5

I want to decrypt a sha256 to text. Is there a way other than bruteforcing to decrypt sha256? Like if I convert that SHA256 to MD5 and then try decrypting?I know its hard and the possible way for ...
3
votes
2answers
130 views

Is there any reason for using private key 2 times when creating security hash?

One of the payment solutions for the websites provides the following way of creating security hash for payment link: hash = sha1(private_key + payment_params_json + private_key); Is there any ...
4
votes
0answers
50 views

Random padding in hash functions

In this answer, it was recommended that you add random padding when hashing messages for a trusted timestamp, such as for predictions, in order to avoid dictionary and brute force attacks (at least ...
2
votes
0answers
51 views

Disallowing Similar Passwords [duplicate]

Upfront, I want to clarify that I am not a professional cryptographer, I am more curious about playing with the math and science behind it, and also want to improve my habits with my own personal and ...
0
votes
2answers
207 views

How hash ensure integrity of data? [duplicate]

I understand what a hash is, basically we calculate a hash and append it to the message and send it to the receiver. If someone alters the message, the receiver will know because there would be a ...
1
vote
0answers
34 views

Hashcat Turkish character problem [closed]

I'm using cudahashcat, it haven't special chars like "öçşĞÜ" in standart charsets. I defined charsets with windows-1254 and other encoding types(and -1 öÖçÇğĞşŞüÜıİ?a parameter), i tried but they ...
-1
votes
3answers
426 views

Which PHP encryption method is most incidentally-secure?

just started researching on the latest PHP encryption methods, I've found out my favorite algorithms are compromised. MD5 is no good, SHA-1 has "found flaws", SHA-512 isn't "meant for passwords", ...
-4
votes
1answer
28 views

What is the most secure way to protect a custom CMS from infiltration? [closed]

I have a custom CMS with a randomly generated ASCII 100-character string from this site for both my username/password. I also have this following sha512 encryption system, which was created by ...
-1
votes
1answer
77 views

Disastrous aftereffects of a hashing attack

I am writing about hashing functions for my thesis. I want to know whether there were disastrous aftereffects of a successful hashing attack in history and what kind of hashing attack was used. ...
0
votes
2answers
99 views

Is my hashing function good enough

Is there an obvious flaw with this hashing function (written in PHP)? function hash($password) { sleep(1); // Make hashing slow $hash = ""; $iterations = strlen($password); for ( $i = 0; $i ...
1
vote
1answer
65 views

John the Ripper missing formats [closed]

I have an sha256 hash that I am trying to crack with John the Ripper. However, it doesn't recognize raw-sha256, raw-md5, or any hash format other than descrypt, bsdicrypt, md5crypt, bcrypt, LM, AFS, ...
1
vote
2answers
57 views

Is it known to what message size are standard hash functions injective?

This simple Python script verifies that all messages of length 1 have different SHA-1 hashes: import hashlib s = set() for i in range(256): s.add(hashlib.sha1(chr(i)).hexdigest()) print len(s) ...
1
vote
0answers
27 views

Is there any merit to the RFC 3414 (SNMPv3 User Security Model) password-to-key method?

RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at ...
1
vote
0answers
26 views

PKCS#7 signed data structure in signed PDF document

Is it mandatory to include PKCS#7 data (OID 1.2.840.113549.1.7.1) octet string into the sequence of PKCS#7 signed data? I mean if you want to sign PDF, you are basically adding PKCS#7 container ...
2
votes
1answer
42 views

Authenticity of PDF document printed from Word

My MS Word Add-In generates PDF preview of DOCX file on client PC and uploads both files to server. I cannot generate PDF on server. Is there any way to make sure that the PDF is the printed version ...
2
votes
1answer
68 views

What is a key-hardened hash?

I've seen the term 'key hardened hash' used to describe a recommended way to tighten up password hashing. What does this mean? Can it just mean to use a pepper?
0
votes
2answers
352 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
1
vote
2answers
73 views

Does recursive hashing weaken properties of a cryptographic hash algorithm?

Specific example of mine concerns the probability of collision, where I have two plain texts A and B that I want to hash using MD5. Given the cryptographic hash function H and the following: A' = ...
2
votes
3answers
518 views

Tracking IP address to prevent abuse without logging user metadata

I am trying to balance good security practices against excessive logging of user metadata / Personally Identifiable Information. I am constructing a web app that allows for secure messaging. In part ...
5
votes
0answers
184 views

Naive implementation of Rainbow Table and/or Hellman's trade-off

This question is the same one I asked here. Since I haven't got any response or even a comment I will post it here as well. Is there any naive implementation of Hellman's cryptanalytic time memory ...
0
votes
2answers
149 views

Is this the most secure encryption/hashing system? [closed]

I've been doing some research regarding password security and after reading several topics and the Kerckhoff's principle. I came up with what I believe is a really secure system regarding online ...
4
votes
2answers
3k views

Should I use urandom() or openssl_random_pseudo_bytes()?

I am developing a site in PHP 5.4. Which function is better to use to generate a random salt for password security? $salt = sha1(openssl_random_pseudo_bytes(23)); or $seed = ''; $a = ...
3
votes
2answers
191 views

Are credit card number look ups more secure with a hash function than with a deterministic encryption algorithm?

I understand PCI DSS 3.0 allows hashes of cardnumbers to be stored separately from encrypted values, but I'm startled at the efficiency of tools like hashcat in discovering card numbers from hashed ...
1
vote
3answers
123 views

How to transform an hash into a usable password?

I was reading about PwdHash and it inspired me to create a little project where you input a master password and an easy to remember alias into a password hash, like bcrypt, and then you get an hash. ...
1
vote
1answer
50 views

Is it fine to store single-use beta keys plain-text?

Is it okay to store single-use beta keys in plain-text in the database? I'll be pre-generating and storing about 2M keys. The keys get passed around so that people can sign up with it, rather than let ...
-2
votes
3answers
118 views

Is it really necessary to hash user passwords when I already protect my database against SQL injection? [duplicate]

I'm developing a school, I just applied all the SQL injection protections that exist and database security, administrative roles, parametrized queries, sanitize input from the client. But FOOL ME! I ...
2
votes
2answers
124 views

Reducing hash output length [duplicate]

I am using output of (keyed) hash function to make sure the input was not modified, I store it along with input. Now output of SHA-1 is 20 bytes. Say I want to reduce the output. And have it output 10 ...
2
votes
0answers
45 views

How secure is Visual host key, and how is SHA2 converted into that representation?

SHA2 has 256 bits of possibilities. Visual host key seems to have the following upper and lowercase = 26*2 numbers and symbols = 20 Additional symbols = 22 Total 94 characters represented in ...
18
votes
3answers
3k views

Is using the concatenation of multiple hash algorithms more secure?

Is it more secure in practice to use the output of multiple hash algorithms instead of a single one (assuming that the output size is the same)? By secure, in this context, I mean protecting against ...
2
votes
1answer
171 views

How can Alice and Bob prove that they share a file?

Carl asks Alice and Bob if they have a file f such that for a secure cryptographic hash function h, h(f) = K. Both claim to have f, but they can't show the file. Carl doesn't believe them. He can ...
12
votes
3answers
5k views

Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?

Given an option , which one should I choose , a HMAC for storing a password securely or a bcrypt or scrypt library?
5
votes
2answers
230 views

How is a hash's algorithm detected based on the hash?

I was reading an Ars Technica article this morning and came across the following towards the end (emphasis mine): Equation Group included six other hashes in different exploits that remain unknown ...
86
votes
6answers
29k views

Password Hashing add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
2
votes
1answer
133 views

Why do major sites(Facebook, Google, etc) still send passwords unhashed? [duplicate]

QUICK SUMMARY: It seems like modern websites, for security's sake, should all have the client hash their own passwords before sending them to the server, who will rehash them, in order to avoid ...
29
votes
7answers
5k views

Hashing a credit card number for use as a fingerprint

What's the best way to hash a credit card number so that it can be used for fingerprinting (i.e. so that comparing two hashes will let you know if the card numbers match or not)? Ideally, I'm ...
76
votes
4answers
16k views

Recommended # of iterations when using PKBDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
4
votes
2answers
48 views

Is hashing schema information for client when generating SQL queries more secure?

I'm planning to implement a web system wherein APIs and presentation for CRUD in data tables are automatically generated, like that in phpMyAdmin. How I plan to implement this is to construct SQL ...