A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

-2
votes
1answer
42 views

client side and server side hash password [duplicate]

Another question about client or server side password hashing, I know. After reading many other post about this topic I'm still a little confused and not completely sure what is the best, because I ...
-2
votes
0answers
36 views

What type of encoding/encryption is this? [on hold]

Im new to encoding and this realm, and I know this is not Base64. Could anyone tell me what this is? ·H AGHü§“-GYÖÍ=cp:S´’u@Ô∂ıAº¨¿mÇ…VÙ®ù¯˘JÂK‚“][ÿ ∞4‹ ...
3
votes
2answers
297 views

Why is a CSR hashed?

What are the use cases for defining something other than the default SHA1 hash in a CSR? Is it to protect the digital signature, public/private keys? What is it protecting exactly?
6
votes
1answer
459 views

What is “c/s” in context of hash cracking?

I was reading hashcat's About page, and the stats are listed in terms of c/s....is that "Cracks per seconds"....the 'c' part seems wrong, I'm just guessing. What is 'c'?
1
vote
1answer
132 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
0
votes
1answer
56 views

Good way to make a secure token for logged out users

I work for a firm that has a marketplace on the web. We want to make a link with a token that stops an ad on the marketplace without the user being logged in. Someone suggested that we make a token ...
0
votes
1answer
26 views

encrypted lookup-keys for key-value store

I'd like to use a key-value store (cassandra, redis, ...), but I don't trust the server. The clients have a shared secret, and I'm using that to encrypt the stored values. But what is the proper way ...
2
votes
5answers
503 views

Is hashing the hash considered an extra level of security [duplicate]

As in md5(md5(md5(x)))... I can remember coming across that in some piece of code. If the attacker can somehow reverse md5(md5(md5(x))) into md5(md5(x)) then he certainly can reverse md5(md5(x)) into ...
0
votes
2answers
102 views

Do hashes repeat themselves?

I am not sure how hashing works exactly, all I know it is impossible to reverse it. All hash types have X amount of characters in them while the phrases and made up words can have an infinite quantity ...
0
votes
2answers
187 views

Is this hash function safe?

Below is the hash function implementation of the roguewave library. It returns a 32 bit hash. The core operation is A = B ^ ((C << 5) | (C >> 27)). Is this hash safe to use as a password check ...
1
vote
4answers
158 views

Should BCRYPT be used for client-side password hashing

I am concerned about the use of bcrypt for client-side password generation. I am developing a password generation function to be used client-side, similar to PwdHash and PasswordMaker. Much has been ...
-2
votes
1answer
97 views

What type of hash is that [closed]

Hey do you guys know the algorithm used to generate this hash? 6874747a3b202063733437373676342f766c2f6e6520753933313538343931206175646960732039‌​353861383a3a36663836392f6e7a3325313638 It's ...
2
votes
1answer
56 views

How to check for presence of LM hashes in local SAM

To get rid of LM hashes in local SAM databases, one can rely on the famous NoLMHash domain GPO, which instructs clients not to store password hashes with the LM algorithm locally ("Do not store LAN ...
2
votes
3answers
231 views

Does figuring out what one password hashes to allow you to crack all identical passwords?

Forgive me, as I am very new to cryptography, but it seems interesting, and I have a question. I'll state my beliefs and please feel free to correct me on the aspects that I'm mistaken so i can ...
0
votes
1answer
42 views

What multiplier to use when calculating the average time to crack passwords with a given entropy?

Suppose that we have a process that generates passwords with entropy E. I'd like to compute the average time it would take for a brute-force attack to crack an MD5-hashed instance of such a password. ...
-1
votes
1answer
65 views

Can HMAC leak the password? [duplicate]

Imaging the following pseudo-code: h = hash(sha512) h.input(password) h.input(message) send h, message to client If the user has the hash and the message, and the only missing variable is the ...
17
votes
4answers
2k views

Should I use own constants when using well known hashing algorithms?

I understand that it is important to use well known and well tested hashing algorithms instead of designing my own. For such there often are reference implementations available, which initialize the ...
2
votes
1answer
142 views

Is encrypting something more than once safer than hashing more than once?

I am aware of the implications that hashing something more than once correctly will increase the security of a system, but doing it incorrectly will decrease it, as noted here and on various other ...
2
votes
4answers
688 views

Using last characters of hash as salt [duplicate]

In a recent discussion somebody mentioned the following hashing scheme: passHash = sha256(password) saltedHash = sha256(passHash+passHash.substr(-10) finalHash = sha256(secret+saltedHash) The ...
21
votes
2answers
5k views

What is the difference between a Hash Function and a Cryptographic Hash Function?

I mean, is it just a matter of "how difficult is it to reverse the function with the current technology"? Or is there a mathematical concept or property that makes them different? If it is a matter ...
3
votes
0answers
51 views

How are secure hashing and encryption algorithms proven? [migrated]

Given that: You should always use proven secure hashing and encryption algorithms, rather than attempting to write your own. What's the process for criteria for an algorithm being proven? Is ...
-2
votes
2answers
41 views

Identifying/decrypting hashed/encrypted data [closed]

This weekend I took part in an security challenge. I had great fun doing it but i found a huge gap in my knowledge that I'm really keen to fill and hope someone here can help get me pointing in the ...
0
votes
1answer
81 views

Tracking IP address to prevent abuse without logging user metadata

I am trying to balance good security practices against excessive logging of user metadata / Personally Identifiable Information. I am constructing a web app that tracks IP addresses to prevent abuse, ...
1
vote
2answers
77 views

Difference between OS X md5 and gnu md5sum

I have installed the "md5sum" utility on my Mac and there was also a "md5" binary pre-installed in /sbin. My problem and question is this: "Isn't MD5 a standard algorithm?" Because I get different ...
1
vote
2answers
338 views

Are newly-generated recovery passwords sent to me via email hashed? [duplicate]

If a company sends me a new password via SMS/email because I clicked "forgot my password." Does that mean the company is not actually hashing my passwords?
-1
votes
4answers
61 views

Confidentiality of file hashes

Context: I have a directory full of sensitive company files. I want to compare these files with a colleague at a remote location, without the need for a secure connection. Is it safe for me to ...
0
votes
4answers
176 views

How does a hashing function always return the same length hash?

I've been looking into what hashing functions are, what they do, &c. I was just wondering: how does a hashing function always return the same length hash? How does hashing work? does not explain ...
-1
votes
3answers
74 views

What does one call the strategy of using “pre-password transforms” as passwords?

Suppose that instead of using, say, Google, let me in! as my Google password, I used some consistent transform of this string, say ZWE1NjMyNm? What search keywords would be helpful to search for ...
3
votes
1answer
139 views

A pair of 'self-signing' hashing functions? [closed]

Does a pair of (hashing) functions for which where neither g(x) nor f(x) are constants exists?
0
votes
0answers
42 views

Do I need a salt when hashing a CSPRNG?

I have passwords stored in my database that are very long CSPRNG and unique. Do I need to use a salt before hashing them? My understanding is that usually you use a hash function in the following ...
4
votes
5answers
582 views

When hashing passwords, is it okay to store the algorithm used right there in the database?

Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
34
votes
5answers
7k views

How does hashing work?

I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it ...
2
votes
2answers
70 views

Should security phrases be hashed?

I didn't think of this before but today I just realised that in soke sites, pw recovery is possible if you know the answers to security questions like What is your mother's maiden name? In this ...
0
votes
3answers
100 views

“Remember me” cookies - did I implement them securely?

I am currently working on a pet project website and I want to implement the "remember me" feature for logins and wanted to know if my procedure is secure. The authentication process basically goes ...
16
votes
2answers
1k views

Methods for slowing down a hashing algorithm

I understand why a hashing algorithm should be slow but is the method that makes it slow important to the strength of the hash? Everything I've read says that the algorithm should be computationally ...
0
votes
3answers
122 views

Did the “Malicious SHA-1” technique enable the NSA to insert a backdoor into SHA-1?

SHA-1 was standardized by the NSA. It appears to be possible to choose the constants in such a way that collisions can be derived easily. Yet, it is not easily possible to discover that the constants ...
0
votes
2answers
77 views

Simplest way of hashing a password with multiple different hash algorithms [closed]

I have a list of plaintext passwords that I would like to hash with various different hash algorithms (for educational purposes). As a minimum I would like to obtain hashes under MD5, SHA1, SHA256, ...
7
votes
3answers
754 views

Not hashing email registration confirmation link

I sent emails out that contains an email registration confirmation link: http://example.com?create=email%3Djay%40gmail.com%26confirm_key%3D53e321f97c145 I do not hash the link above. Before I sent ...
0
votes
1answer
81 views

Native app, token authentication without login/password

I'm working on a always online mobile game (native android/iOS app with Unity) and i would like to be able to authenticate the player without requiring any login/password at the beginning. For those ...
8
votes
2answers
514 views

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
7
votes
2answers
1k views

Is it bad practice to ask only for individual characters of a password? [duplicate]

Some financial websites that I use use passwords in a peculiar way. Instead of asking me the whole password string, they only ask me to enter e.g. "3rd, 5th and 8th character of your password", i.e. a ...
3
votes
3answers
163 views

SHA and “Bits of Security”

I've researched several forms of encryption/hashing and have often come across the term "bits of security". For example, at least one source claimed SHA-256 = AES128 = ECC256 = 128 bits of security. ...
2
votes
2answers
81 views

Related-password hash security

Say we are given a strong cryptographic hash function hash(), a strong completely random password of 15 characters pass15, two single-character salt values salta, saltb. We compute the hashes hasha, ...
4
votes
2answers
2k views

openssl_digest vs hash vs hash_hmac? Difference between SALT & HMAC?

openssl_digest vs hash vs hash_hmac I want to use SHA512 for storing password. Which of the above methods are best to use? Why? What is the difference between SALT & HMAC? I just read ...
5
votes
4answers
6k views

Bank account number and account holder in check exposed?

I'm not sure if this is standard practice in all banking institutions but almost all banks where I've received checks the account number of the issuer is exposed (some even the account name). Isn't ...
136
votes
18answers
13k views

What is a good analogy to explain to a layman why passwords should be hashed?

Note: This is not an actual situation I'm currently in. Assume your boss is one of those old-fashioned computer-illiterate managers and wants to store the passwords in plaintext to simplify ...
1
vote
2answers
306 views

Hash user id securely

In my app I'm using Facebook login and creating a local user in my DB after retrieving the data. When saving the Facebook ID in the DB I need to hash it, as I don't want the ID to be in clear text if ...
22
votes
6answers
19k views

Most secure password hash algorithm(s)?

What is/are currently the most cryptographically secure hashing algorithm(s)? (available in PHP) Speed is irrelevant, because I'm iterating the hash over a fixed time (rather than a fixed number of ...
-1
votes
1answer
47 views

Can I test/determine all decryption types on an unkown filetype. I do have the password [closed]

I have a file that's nearly 200Mb. It was reportedly packed/encrypted with Kruptos 2. But it has a .~enc extension. The header of the file is pure gibberish. Running file says it's data running ...
-1
votes
3answers
72 views

Can I safely use my own statistics to assess password strength on number of times a password is used?

Lets assume I want to give my hypothetic 10mio users userbase a good feedback on their password strength. Besides the classical entropy tests and top500 list of bad passwords, I might want it to be ...