a cryptographic hash function with a 128-bit (16-byte) output, now deprecated

learn more… | top users | synonyms

-1
votes
0answers
29 views

Security in app -> server communication using random 128 bit passwords

I've been visiting this site over from StackOverflow to learn about hash functions for password storage on a server, but none seem to cover my case: App programatically generates a username and ...
-7
votes
2answers
110 views

What is is the best way to create virus signature database? [closed]

We are thinking to develop a new Antivirus program. The main concern is to create a virus signature database. I want to ask what is the best possible way to add viruses signature in our database to ...
1
vote
0answers
30 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
-1
votes
2answers
97 views

Decrypting a very simple key [closed]

I'm doing a basic cryptography course and a question is asking to to decipher: ...
3
votes
2answers
94 views

Are there any known MD5 hash collisions of messages of different length?

All the examples of MD5 hash collisions I've come across comprise two different messages (inputs) of the same length. The first and second messages have different values for a number of bits and the ...
4
votes
1answer
71 views

X.509 Certificate Signature Collision Vulnerability

Customer complained that during security scan performed on our application the following was raised: 172.22.0.19 - xxxxx - IETF X.509 Certificate Signature Collision Vulnerability - ...
33
votes
4answers
3k views

Does every hash value have an inverse value?

There are many different hash functions, md5, sha, and others. They take a value V and produce a H via transformation Function(V) = H, where Function is md5, sha, etc. My question is: Does every hash ...
0
votes
1answer
42 views

Md5 vs Md4 recognition

Is there a way to actually find out whether a hash is MD5 or MD4? For instance: 10c7ccc7a4f0aff03c915c485565b9da is an MD5 hash be08c2de91787c51e7aee5dd16ca4f76 is an MD4 hash I know that there ...
0
votes
1answer
113 views

How can I detect if hashes are salted? [duplicate]

Is it possible to detect hash function of a hash if I don't have access to PHP code? I know that if a hash is some kind of MD5, but I don't know if there is salt etc.
2
votes
1answer
86 views

Is MD5 ok to use if salted?

This post: http://www.gaiaonline.com/journal/?mode=view&post_id=19734573&u=8357925 Said that salted MD5 is ok but regular MD5 would not be ok. I am a bit confused about this and would ...
-2
votes
1answer
100 views

How MD5 and salt algorithms come into play if the attacker uses curl?

When the user logs into any site, they supply a username ('user01') and password ('password123') into a form then submit. The user has no idea what their hashed password value is that is stored in the ...
1
vote
2answers
73 views

Do you need to check the entire md5 hash value

Is there any likelyhood that two different versions of the same file will produce the same characters at the start of the hash and at the end of the hash (say, the first/last five characters) - is it ...
2
votes
1answer
90 views

Flaw in HTTP Digest Authentication

I am working through my textbook and I came across this question: Below is the message format for a browser response to access a password-protected web page using HTTP digest authentication. GET URI ...
4
votes
1answer
155 views

Why is Windows password security designed this way? [duplicate]

Let's start with the LM hash. The LanMan hash had MONUMENTAL security flaws, like the password being case insensitive (converted to upper), which reduced the keyspace for a brute force attack. On top ...
5
votes
2answers
566 views

Why not slightly modify an existing hashfunction to create your own? [duplicate]

I read this interesting question on why improvising your own Hash function out of existing hash functions is bad. However this is specifically focusing on 'mixing' existing hashfunctions. What if for ...
-3
votes
1answer
73 views

Hash regex for malware recognition [closed]

I'm looking to store two types of hashes for recognizing blacklisted code. These are the FireEye "import hash" (or imphash) and the ssdeep "fuzzy hash". Is there a regex (or formal documentation) I ...
3
votes
1answer
479 views

Can I know somehow if my password hash is known?

Is there a secure way to know if my password's hash is publicly known on the internet? First I tried to search for it in Hashes.org (http://hashes.org/search.php), but then I suspected, that if it ...
2
votes
0answers
45 views

Is the 64-bits length of the original string padded as well in the MD5 hashfunction?

So, for example I have a string which binary value is exactly 512 - 64 bits long, so the binary conversion of the string does not have to be padded. So that means I have a string of 56 chars. The ...
4
votes
3answers
114 views

Can a file have the same MD5SUM but different SHA-1 results from different tools?

I have one file. SHA-1 and MD5 have been generated long time back. I do not know which tool has been earlier. Recently I generated SHA-1 & MD5 for the same JAR. Surprisingly I found that MD5 is ...
24
votes
1answer
2k views

How can the content of a file refer to its own MD5?

So I just saw this picture on Imgur: http://imgur.com/gxRCrCM The intriguing thing about it is that the picture refers to an old Daft Punk song named "Face 2 Face". The image's MD5 is ...
4
votes
2answers
884 views

What's the purpose of $LoginKey from the Ashley Madison leak?

According to this site Ashley Madison was keeping an insecure hash stored in their database using MD5, in addition to the far more secure bcrypt hash. This group used the MD5 hashes to quickly crack ...
0
votes
1answer
151 views

Is it possible to find out the salt of a MD5 hash?

I want to know whether it is possible to find out the salt of a MD5 hash? For instance we've got two MD5 hashes helloworld -> fc5e038d38a57032085441e7fe7010b0 goodbyeworld -> ...
2
votes
2answers
227 views

MD5 brute force on a faulty hash?

MD5 for passwords is considered insecure due to the ability to brute force and pick up the result. But what if I change some characters of an MD5 hash and I keep a record of that change so that ...
2
votes
3answers
228 views

Hashing passwords in OpenLDAP

I've seen a few posts on the internet saying most people store user passwords in OpenLDAP using one of OpenLDAP's many, built-in hashing functions. But OpenLDAP itself recommends handing off password ...
3
votes
1answer
149 views

What's the weakness of keyed-MD5 for message authentication?

I've seen public web API's using keyed-MD5 to generate message authentication code rather than adopting the HMAC algorithm. People wouldn't just invent HMAC for fun, so it must have some advantages ...
1
vote
2answers
93 views

Verifying Client with Server

I'm currently designing a basic Java program that uses sockets to communicate from a server to multiple clients. I want the clients to be unmodified, however, to prevent against users trying to use ...
0
votes
0answers
107 views

Would it take long to brute force a md5 hash like this?

1be8917510-36.51929856278002 10bce1af27-99.18403192423284 103fa11cc6-87.21158325206488 Few examples above and as you can see the pattern is: 1xxxxxxxxx-{a percentage (0-100) to 14 decimal places} ...
1
vote
1answer
124 views

Brute force a password with a lot of hash (of the same password)

I have a list of approximatively 1000 entities, defined using the following code : list[i] = md5_salt_unix_hash(random_salt, password) Where the random_salt is generated in each iteration and the ...
23
votes
4answers
4k views

Why are MD5 and SHA-1 still used for checksums and certificates if they are called broken?

I was just reading about SSL/TLS stuff, and according to this site (which is rated as A by Qualys SSL Labs), MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And yet, I noticed ...
1
vote
1answer
66 views

Are multiple applications of a salted Linux MD5 hash easier to break than one? [duplicate]

I hashed the same password a lot of times (approximatively 1000 times) using the salted Linux MD5 format. I want to know if it's easier to recover the clear password or not. Is there something that ...
-1
votes
2answers
2k views

SHA256 to text or MD5

I want to decrypt a sha256 to text. Is there a way other than bruteforcing to decrypt sha256? Like if I convert that SHA256 to MD5 and then try decrypting?I know its hard and the possible way for ...
-1
votes
1answer
100 views

Disastrous aftereffects of a hashing attack

I am writing about hashing functions for my thesis. I want to know whether there were disastrous aftereffects of a successful hashing attack in history and what kind of hashing attack was used. ...
1
vote
2answers
127 views

Is it known to what message size are standard hash functions injective?

This simple Python script verifies that all messages of length 1 have different SHA-1 hashes: import hashlib s = set() for i in range(256): s.add(hashlib.sha1(chr(i)).hexdigest()) print len(s) ...
1
vote
1answer
713 views

Hashcat passwordcracking separator unmatched

I have the task to crack a bunch of passwords like: $1$V5l3qvml$Q.fDn30gGhjcEIZH8utah/ $1$DcuX.dRK$bR4utyGQ4ET4sobpMMtfo0 $1$WbXWIqFu$Qu1fT/MmTIvSUz4xw4mlI0 $1$8Y7TfkZ5$LnuF99mgFbV1wvQ61dMZB1 I ...
2
votes
2answers
123 views

Does recursive hashing weaken properties of a cryptographic hash algorithm?

Specific example of mine concerns the probability of collision, where I have two plain texts A and B that I want to hash using MD5. Given the cryptographic hash function H and the following: A' = ...
3
votes
1answer
245 views

Indicators of Compromise

Just to get an understanding of how indicators of compromise works. Take For example, in this article, the SMB tool. There is a MD5 hash for it. So is my firewalls or IDS supposed to be able to detect ...
9
votes
1answer
836 views

Checksums do not match when I download file over http

Just for the test I did the following: Downloaded a page from wikipedia via wget on remote server and named the file test.dat. Then I executed md5sum. I download the file via http and check it back ...
5
votes
2answers
933 views

openssl enc uses md5 to hash the password and the salt

Wikipedia states that md5's collision resistance is 2^18 (https://en.wikipedia.org/wiki/MD5). I just found out that openssl enc uses md5 to hash the password and the salt. Let's assume that I want ...
0
votes
1answer
246 views

Please help clarify password hashing - salted, multiple iterations of MD5 vs bcrypt/sha2, etc [duplicate]

I was reading an article about the Ars Technica hack here and had a couple of questions. The commenter said: "PHPass uses salted and iterated MD5 to hash passwords" My question is that if I were ...
2
votes
2answers
179 views

How secure is a MD5 hash of an 128bit key

Apparently, for the Android KeyChain an encrypted master key is stored along the MD5 hash of the unencrypted Key. How secure is that? MD5 is known to have collisions, but I guess we can assume with an ...
-9
votes
1answer
280 views

Someone help me decode this [closed]

What type of hash is this? a9df6dcd35f4e7223ff3dd087abcc266 I can't find anything when I decrypt it. Please someone decrypt it
1
vote
1answer
70 views

Multi hash security [duplicate]

Is md5(sha1(pass)) more secure than md5(pass)? For example in case of sqli when attacker cant get our hashing schema, brute force or dictionary attack would be much less efficient. Am i right or is it ...
2
votes
1answer
2k views

John the Ripper - Calculating brute force time to crack password

I'm using incremental mode (brute force) mode in John the Ripper to crack Linux MD5 passwords. I'm trying to calculate the time it will take to run through all combinations of 12 passwords (with 12 ...
2
votes
1answer
670 views

How strong is PDF security/encryption?

I want to securely convey a PDF document containing sensitive information from my system to another system. The latter is operated by a different person, whom I trust. However, this person does not ...
1
vote
0answers
175 views

Can't see advantages of rainbow tables over hash tables [closed]

I've read about rainbow tables (which I've confused with hash tables at first). I understand that it uses a reduce function R(x) and by saving start value P(plaintext) and ending hashed value H I can ...
4
votes
2answers
532 views

How safe is to secure sensitive content by URL with MD5 hash and no other authorization?

Suppose we have website that use MD5 hash in URL like this: http://somewebsite.com/XXX/ where XXX is MD5 hash. Content of this website may have sensitive information like transaction details with ...
0
votes
1answer
74 views

Good way to make a secure token for logged out users

I work for a firm that has a marketplace on the web. We want to make a link with a token that stops an ad on the marketplace without the user being logged in. Someone suggested that we make a token ...
2
votes
4answers
641 views

Is hashing the hash considered an extra level of security [duplicate]

As in md5(md5(md5(x)))... I can remember coming across that in some piece of code. If the attacker can somehow reverse md5(md5(md5(x))) into md5(md5(x)) then he certainly can reverse md5(md5(x)) into ...
3
votes
2answers
874 views

Difference between OS X md5 and gnu md5sum

I have installed the "md5sum" utility on my Mac and there was also a "md5" binary pre-installed in /sbin. My problem and question is this: "Isn't MD5 a standard algorithm?" Because I get different ...
0
votes
2answers
246 views

Is there any reason to send file checksum for signed, encrypted files with MDC

I am using OpenPGP and sending a signed, encrypted file with forced MDC (Modification Detection Code) over the network. In typical file transfer scenarios where security is not in picture, an md5 ...