A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

11
votes
4answers
6k views

Whats the difference between MAC vs hash

What is the difference between the two algorithms? One difference that I know of, is that MAC is keyed and hash is not.
0
votes
2answers
75 views

Which hashing algorithm is ideal for use on the web? [duplicate]

I am new here, and have poked around the site looking for an overview of which hash algorithm to use on the web and why. It seems to be the consensus that SHA-256 or other SHA-2 family algorithms are ...
2
votes
3answers
941 views

Will SHA1 of Email Addresses Always be Unique?

We want to store data about a person without storing their email address, but we want to latter connect that person with their data upon them supplying their email address. Storing a SHA1 of their ...
1
vote
2answers
50 views

Is hashing a DLL useful to protect from DLL hijacking?

I want to make sure that the dynamic link libraries used by my application can't be replaced with other libraries of the same name, in order to inject malicious code. Therefore, I thought about ...
0
votes
0answers
7 views

What can I change in Lane to [migrated]

What can I change in Lane to increase memory (and compute) consumption. My first idea would be to change n, but with Lane hash function is there a way I can up the n to a level higher than 512. If I ...
-3
votes
1answer
61 views

Is there a way to attack the SHA-3, GOST, and WHIRLPOOL hash functions? [on hold]

Is there a way to attack SHA-3, GOST, and WHIRLPOOL hash functions?
20
votes
3answers
6k views

How can I create a password that says “SALT ME!” when hashed?

How can I create a password, which when directly hashed (without any salt) with md5 will return a string containing the 8 characters "SALT ME!". The hope is that a naive developer browsing through his ...
1
vote
1answer
71 views

FIPS 140-2 C# Password Hash

Is the following algorithm, using RNGCryptoServiceProvider & Rfc2898DeriveBytes, sufficient to implement a FIPS 140-2 password hash on Windows Server 2008R2? var provider = new ...
2
votes
2answers
117 views

Keepass Dictionary Attack Protection Strategy

Though pretty interested, I'm everything but an expert in Information Security, please redirect me to any helpful resources if my question is stupid or correct me if my assumptions are wrong. When ...
1
vote
1answer
55 views

NTLM/LM Hashes on Domain Controller

I've noticed that when extracting password hashes from a domain controller (using Elcomsoft proactive password auditor) sometimes I'll get LM and NTLM hashes and other times I'll only get NTLM hashes. ...
0
votes
0answers
21 views

Length-constant password comparison in scrypt? [duplicate]

E.g.: XORing the candidate against stored then comparing against 0. Do I need to worry? (my question is much in the same style as this question: Does bcrypt compare the hashes in ...
0
votes
3answers
110 views

Cryptosytem Question

A file is encrypted and placed on a secure FTP server. An MD5 hash is taken of the file and also placed on the FTP server. A userlogs in to the server and downloads both files, however, the hash fails ...
2
votes
1answer
64 views

How difficult it is to solve a salt if knowing the original data and the hash output that uses the SHA-2 algorithm

I am reading the documentation for Kentico where it describes using hashes to validate query strings ...
1
vote
3answers
148 views

Time Memory Trade-Off Attacks

Given, we want to crack a password. With Time Memory Trade-Off Attacks one tries to find the right balance between time to compute hashes for all possible passwords. And the used memory to store all ...
2
votes
4answers
135 views

Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself? [duplicate]

I have moved this question from stackoverflow to this place. I know it may be a question about 'opinion' but I am not looking for a private opinion but a source of the final decision to keep it this ...
10
votes
6answers
1k views

Do salts have to be random, or just unique and unknown?

First of all, my motive is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database. After discussion in comments and in ...
1
vote
1answer
52 views

Hashing password for secure storage (generating salt)

I wanted to check if the following means of generating a hash for storage of a password was secure. I have an username and password combo. In order to generate a secure hash, I am doing the ...
1
vote
1answer
66 views

What to do with .hash files when cracking WPA2

So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the ...
3
votes
2answers
116 views

Using public key infrastructure or hashing for personal identification privacy?

I've been reading about identity theft recently, and I'm wondering about some possible solutions using the techniques of asymmetric/symmetric/hashing in encryption. My idea is going to cross those 3 ...
3
votes
1answer
23 views

Is it possible to slow down the Blue Midnight Wish cryptographic hash function?

In the Blue Midnight Wish (BMW) cryptographic hash function, is there a variable I can use to increase memory/CPU resource consumption to slow down the password hashing process? Call me crazy, but I ...
1
vote
0answers
44 views

Identify Known Malware By Hash (MD5) Across Network [migrated]

I need to design a solution that will allow me to submit a series of MD5 hashes and then be alerted if these hashes are found on any machine (Windows) on the network. I'm open to existing solutions ...
0
votes
0answers
56 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
-1
votes
1answer
36 views

Minimize collision risk for any hash function?

What's some good advice on eliminating collisions when hashing things? I need a unique identifier for all my users, but I want them to be private. I'm thinking of using ODIN-1 ...
28
votes
8answers
2k views

Why improvising your own Hash function out of existing hash functions is so bad

I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes. After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
24
votes
10answers
824 views

Does hashing a file from an unsigned website give a false sense of security?

Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
0
votes
1answer
45 views

Securing passwords for REST Authentication

first post on sec so go easy. I'm developing a REST application using the Spring Framework, as as part of the requirements, we have to secure the different functions of the system to different user ...
0
votes
1answer
61 views

Cryptographic Hash function [closed]

How can I implement a cryptographic hash function using the block cipher? I was wondering whether I can use AES in cipher block chaining mode to achieve this.
0
votes
1answer
36 views

Is there an anti virus that protects processes from being injected code to?

As title says, is there an av that does that? And if not, is there any other program that protects processes like lsass in windows, apart from protected process utility in win8.1?
2
votes
2answers
230 views

Hash function with configurable length

Here's a short question: does a hash function with configurable length exist? And if not, why not? Would it be a problem?
0
votes
1answer
72 views

Is using MD5 in NTLMv2 protocol to store Windows passwords is secure?

I read that Windows (probably not new OSs but say, Windows Server 2008) stores passwords using Hashes using NTLMv2 protocol which uses MD5 hash function. My questions: MD5 is known to be insecure ...
-3
votes
1answer
29 views

How many possible symbols and punctuations in a password? [closed]

I want to compute the possible combinations of a password consists of 8 digits of: alphabetical letters (26), numbers (0-9), symbols and punctuations. In order to compute this, I have to know the ...
2
votes
1answer
79 views

Locality Sensitive Hash (LSH) function to approximately match old passwords

Recently, I ran across a website that requires me to change my password after X number of days had passed since I had last created one. Intelligently, the service made sure that the password did not ...
1
vote
1answer
131 views

Hashing the cookie token for persistent login

In a login system I'm doing, I'm using a per-user, per-device randomly generated cookie token. A part of the script looks like this: // Generate current device's token $token = ...
1
vote
2answers
101 views

How to treat/hash ECDH shared secret to use as keys for AES?

I'm doing some studies/development for a security system that would use ECDH with ephemeral keys. In my code I'm currently using a 256-bit EC, so when the two parts compute the shared secret, I get a ...
21
votes
3answers
2k views

Is there any advantage to splitting a password?

I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm. The LM hash is computed as follows: The user’s ASCII password is converted to uppercase. ...
0
votes
1answer
45 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
1
vote
0answers
31 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
0
votes
1answer
39 views

How does LM hash deal with passwords that are between 8 and 13 chars

If its 14 then it splits it to 7&7, but how about 13 characters? 7&6? How does it work?
7
votes
3answers
507 views

Does hashing a PRNG make it cryptographically secure?

Would hashing the result of a regular random number generator produce a cryptographically secure PRNG? For example, would sha1(rand()) effectively be a secure PRNG? Assuming it doesn't, how would ...
-1
votes
3answers
40 views

Hashing algorithms [closed]

How can you tell which hashing algorithm is being used on a system? We are using 2048 bit encryption and wondering how to tell if hashing algorithm SHA-1 with SHA-2 is being used.
2
votes
4answers
204 views

How does a system authenticate a user using a hash function, after it has been salted?

I don't really understand how salting works. I read the Wikipedia article, but I still don't understand how can a system authenticate a salted hash? Let's say a user chooses a password. It's randomly ...
95
votes
7answers
6k views

Why are salted hashes more secure?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...
3
votes
4answers
289 views

True?: “Nearly all encrypted passwords are stored with the last character in clear text”?

[S]ome passwords are gleaned by hacking into computers where intruders can find stored passwords. Those are stored in encrypted form, but there's software that can attack the encryption. Nearly ...
3
votes
4answers
234 views

When and where do I hash a password?

Say I have a client and a server. I want the user with the client to login to the server with a username and password combination. To login, they have to enter the right password which (when hashed) ...
0
votes
1answer
56 views

What kind of encoding/hash it is [closed]

I have email which is stored in Cookie : %2FGl%F8%7E%06%F1S%FEF%10%E0T%B3%95%82BK%D9%D3%94%BC%AE%E1 which is sth like this after convert it with this tool : ...
2
votes
2answers
70 views

Why use PBKDF2 over multiple iterations of a another cryptographic hash function?

People often recommend PBKDF2 over using hash functions directly, but typically they compare PBKDF2 to a single unsalted hash. What advatages are there to using PBKDF2 over multiple iterations of a ...
110
votes
5answers
9k views

Does Facebook store plain-text passwords?

I was about to reset my Facebook password and got this error: Your new password is too similar to your current password. Please try another password. I assumed that Facebook stores only password ...
13
votes
1answer
921 views

Why does Facebook bother comparing old and new passwords?

An answer to this question says Facebook generates a bunch of password guesses to see if they hash the same as a previous version of the password. Why bother? If a service forces every password to ...
0
votes
1answer
44 views

Verify external data files for an application

I have a C++ application with an algorithm, whose usage I want to protect. The application needs several input data files to work (those may change for each client). My goal is to allow only ...
2
votes
4answers
207 views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesnt even have support for SHA or other algorithms. But I can think of quite a few advantages, ...