A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

9
votes
2answers
149 views

Can client-side hashing improve after-the-fact security in response to password leaks?

Several questions on this site address client-side password hashing, and none of them admit to any security benefit beyond protecting other sites the user might use the same password for. However, ...
-2
votes
2answers
90 views

Strength of WPA passwords

How long would it take to crack an 8 letter (latin alphabet, lowercase) password of a WPA PSK network? Is it in reach of a single PC running hashCat?
5
votes
1answer
165 views

How to store/encrypt fingerprint?

Storing password is a no brainer : use a password hasher. But.. How do you proceed to store fingerprints securely on your server? Meaning that even if your server and all it's data is stolen, someone ...
5
votes
1answer
137 views

Random padding in hash functions

In this answer, it was recommended that you add random padding when hashing messages for a trusted timestamp, such as for predictions, in order to avoid dictionary and brute force attacks (at least ...
3
votes
1answer
64 views

Distributed tokenization for credit card numbers

I have two locations within the same firm that hold credit card numbers. I want to be able to "join" on credit card number to do business analytics after transmitting card number-linked data from one ...
2
votes
1answer
108 views

Is it fine to store single-use beta keys plain-text?

Is it okay to store single-use beta keys in plain-text in the database? I'll be pre-generating and storing about 2M keys. The keys get passed around so that people can sign up with it, rather than let ...
1
vote
1answer
70 views

Hashing passwords in OpenLDAP

I've seen a few posts on the internet saying most people store user passwords in OpenLDAP using one of OpenLDAP's many, built-in hashing functions. But OpenLDAP itself recommends handing off password ...
1
vote
1answer
82 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
1
vote
1answer
226 views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? Where would one get said tables or can they be ...
1
vote
1answer
20 views

Is the method of hardening the creation of a Cryptographically Generated Address (CGA) called hash extension

CGAs are sha1 hashes truncated to a 59 bit value. Along with a 3 bit security parameter they form a IPv6 address (more precisely the interface identifier). from wikipedia: The Sec parameter ...
-1
votes
1answer
243 views

Why not use md5 auth mechanisms for IMAP over TLS?

I'm using Dovecot for IMAP connections. I've read a lot of tutorials on how to set up Dovecot, and a lot of them said to only allow: auth_mechanisms = plain login Why should I not allow *-md5 ...
-4
votes
1answer
69 views

How to identify this hash?

I have one hash, I know its value, but not its type. Here is it: 6dfb036bf703d75f9bc8219ba1224d876783fa61 I tried something like php -r "echo sha1('abc');", but it gave me another value, so this ...
5
votes
0answers
294 views

Naive implementation of Rainbow Table and/or Hellman's trade-off

This question is the same one I asked here. Since I haven't got any response or even a comment I will post it here as well. Is there any naive implementation of Hellman's cryptanalytic time memory ...
4
votes
0answers
88 views

Sqlmap trimming output

I've decided to learn Sql/map but having an issue with Sqlmap trimming some of my output, the hash. The hash is about to be 32 characters long but I'm only getting 25 and the warning: [WARNING] ...
3
votes
0answers
109 views

How does SHA3 (Keccak & SHAKE) compare to SHA2? Should I use non-SHAKE parameters?

Keccak is the winner of the SHA3 competition. Since Keccak is highly customizable (presumably for security/memory/time/speed tradeoffs) there does seem to be some controversy around how Keccak ...
2
votes
0answers
41 views

CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
2
votes
0answers
403 views

How do I convert from this weird John/Asleap format to lc (for HashCat)?

I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
1
vote
0answers
161 views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
1
vote
0answers
69 views

John The Ripper and OpenCL on AMD FirePro

Trying to work with John 1.8.0 Jumbo 1 I noticed that OpenCL won't work for me. I used autoconfig (meaning configure and build with the option to enable OpenMPI) in order to build JTR for my Mac Pro. ...
1
vote
0answers
58 views

Is there any merit to the RFC 3414 (SNMPv3 User Security Model) password-to-key method?

RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at ...
1
vote
0answers
128 views

PKCS#7 signed data structure in signed PDF document

Is it mandatory to include PKCS#7 data (OID 1.2.840.113549.1.7.1) octet string into the sequence of PKCS#7 signed data? I mean if you want to sign PDF, you are basically adding PKCS#7 container ...
1
vote
0answers
103 views

Breaking it gently

Let's say I've found a fundamental error with mathematics of a security package. For example, let's say I've found something similar to the Pollard’s \rho-1 algorithm that renders some of the RSA keys ...
1
vote
0answers
1k views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
1
vote
0answers
176 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
1
vote
0answers
73 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
1
vote
0answers
193 views

Persistent login by hashing password hash

It seems that persistent logins are technically the same as storing a password on the client, and therefore should be avoided whenever possible. However, real life users would be unhappy with having ...
1
vote
0answers
136 views

Login details security using salt n hash and a login role in postgresql

I am coding up the security for a website in express.js and postgresql db. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but my ...
0
votes
0answers
29 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
0
votes
0answers
119 views

Line Length Exception in hashcat

I'm very new to cracking a password so sorry if I sound stupid. I am trying to get my admin password from my second PC (I lost it). I did find the SAM file with kali linux and with bkhive and samdump ...
0
votes
0answers
55 views

What is the format of PDF hash?

When I use a tool like pdf2john.py from John The Ripper on an encrypted PDF, it gives me an output like: ...
0
votes
0answers
52 views

Designing a security system for road pricing

It's my first semester with Information Security and I still feel a little lost. Sorry in advance for stupid mistakes I may have made. the examples in round brackets below are my own ideas, wrote ...
0
votes
0answers
45 views

Understanding the application of hashes, HMACs, and KDFs

I think that I understand the right application cases for the following crypto functions, but I'd like to confirm my understanding and also propagate the safe use of crypto throughout the intertubes. ...
0
votes
0answers
23 views

Is it possible to pass the hash with a hash captured from spoofing NBNS responses?

I know that it is possible to use a hash obtained from the Windows SAM in a pass the hash attack, simply setting the hash for the SMBPass paramter for various modules in metasploit. Can a hash ...
-1
votes
0answers
68 views

PHP crypted or hashed string to decode

I have a problem for captcha solve in 3 days. This is crypted or hashed captcha cookie 55debbcf069c81440660431 23 characters long. I found last 10 character is 1440660431 timestamp. I think first 13 ...
-1
votes
0answers
76 views

Best way to keep encrypted data, which is often decrypted?

I'm starting project for my BSc, where I want to send e-mails with keys (e.g. games on Steam platform, Paysafecard) on Allegro, which is similar to eBay. I will have my own database with users' data ...