A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

1
vote
2answers
99 views

How to treat/hash ECDH shared secret to use as keys for AES?

I'm doing some studies/development for a security system that would use ECDH with ephemeral keys. In my code I'm currently using a 256-bit EC, so when the two parts compute the shared secret, I get a ...
1
vote
2answers
122 views

Time Memory Trade-Off Attacks

Given, we want to crack a password. With Time Memory Trade-Off Attacks one tries to find the right balance between time to compute hashes for all possible passwords. And the used memory to store all ...
3
votes
1answer
19 views

Is it possible to slow down the Blue Midnight Wish cryptographic hash function?

In the Blue Midnight Wish (BMW) cryptographic hash function, is there a variable I can use to increase memory/CPU resource consumption to slow down the password hashing process? Call me crazy, but I ...
2
votes
1answer
76 views

Locality Sensitive Hash (LSH) function to approximately match old passwords

Recently, I ran across a website that requires me to change my password after X number of days had passed since I had last created one. Intelligently, the service made sure that the password did not ...
1
vote
1answer
51 views

FIPS 140-2 C# Password Hash

Is the following algorithm, using RNGCryptoServiceProvider & Rfc2898DeriveBytes, sufficient to implement a FIPS 140-2 password hash on Windows Server 2008R2? var provider = new ...
0
votes
1answer
43 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
2
votes
0answers
44 views

a pair of 'self-signing' hashing functions

I wonder if does it exists a pair of (hashing) functions for which g(m) = f(m + g(m)) and (of course) g(x) and f(x) are not constants ?
2
votes
0answers
119 views

How do I convert from this weird John/Asleap format to lc (for HashCat)?

I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
1
vote
0answers
30 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
1
vote
0answers
48 views

Persistent login by hashing password hash

It seems that persistent logins are technically the same as storing a password on the client, and therefore should be avoided whenever possible. However, real life users would be unhappy with having ...
1
vote
0answers
39 views

Login details security using salt n hash and a login role in postgresql

I am coding up the security for a website in express.js and postgresql db. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but my ...
0
votes
0answers
38 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...