0
votes
0answers
130 views

John the Ripper - Calculating brute force time to crack password

I'm using incremental mode (brute force) mode in John the Ripper to crack Linux MD5 passwords. I'm trying to calculate the time it will take to run through all combinations of 12 passwords (with 12 ...
2
votes
2answers
118 views

How safe is to secure sensitive content by URL with MD5 hash and no other authorization?

Suppose we have website that use MD5 hash in URL like this: http://somewebsite.com/XXX/ where XXX is MD5 hash. Content of this website may have sensitive information like transaction details with ...
0
votes
1answer
64 views

Good way to make a secure token for logged out users

I work for a firm that has a marketplace on the web. We want to make a link with a token that stops an ad on the marketplace without the user being logged in. Someone suggested that we make a token ...
2
votes
5answers
519 views

Is hashing the hash considered an extra level of security [duplicate]

As in md5(md5(md5(x)))... I can remember coming across that in some piece of code. If the attacker can somehow reverse md5(md5(md5(x))) into md5(md5(x)) then he certainly can reverse md5(md5(x)) into ...
1
vote
2answers
98 views

Difference between OS X md5 and gnu md5sum

I have installed the "md5sum" utility on my Mac and there was also a "md5" binary pre-installed in /sbin. My problem and question is this: "Isn't MD5 a standard algorithm?" Because I get different ...
0
votes
2answers
127 views

What is the collision likelihood of MD5 when non-numeric values are removed?

Start with a unique identifier String macAddress = "CC:3A:61:24:D6:96"; Hash the identifier via MD5 implementation String hash = md5(macAddress); //bd37f780e10244cf28810b969559ad5b Remove all ...
0
votes
2answers
535 views

Reversible Hash Function?

Is there any reversible hash function? The hash function like SHA and MD5 are not reversible. I would like to know if there exist some reversible hash functions?
3
votes
3answers
207 views

Client-side hashing of password before sending it from login form [duplicate]

I have just realized, that my web application is sending unencrypted passwords from login form. It's just like that -- I've analysed, that string sent by user from login form is hashed with MD5 (which ...
1
vote
1answer
357 views

Cracking MD5 passwords with the same salt

How long would it take to crack passwords up to 10 letters long if you knew the hashes were MD5 with a salt (that you know)?
-1
votes
4answers
134 views

Is salted MD5 or salted SHA considered secure?

Is using something like bcrypt or scrypt necessary? The hashes are so much longer to store in a database. Can one get away with using salted MD5 or SHA and still be secure?
0
votes
2answers
96 views

Is a long salt usually sufficient for security purposes, even with MD5?

I always hear that MD5 is too fast for effective password crypto because you can crack up to 6 characters very quickly (or is this number higher now)? But what if the salt you use is really long and ...
1
vote
1answer
122 views

What are the enhancements of SHA1 compared to MD5?

I am looking for enhancements of SHA1 when its compared to MD5. But I am not talking about just heap sizes. I am talking about different enhancements than heap size. Also, I think md5 is faster than ...
-3
votes
2answers
404 views

Can NSA generate all hashes for rainbow table to break md5?

I was wondering about md5 encryption. It is good, and I agree that it is unbreakable. But this is why we have rainbow tables. What if bunch of people gather together and start brute forcing and ...
1
vote
1answer
109 views

Is hashing a DLL useful to protect from DLL hijacking?

I want to make sure that the dynamic link libraries used by my application can't be replaced with other libraries of the same name, in order to inject malicious code. Therefore, I thought about ...
1
vote
2answers
209 views

Which hashing algorithm is ideal for use on the web? [duplicate]

I am new here, and have poked around the site looking for an overview of which hash algorithm to use on the web and why. It seems to be the consensus that SHA-256 or other SHA-2 family algorithms are ...
53
votes
3answers
18k views

How can I create a password that says “SALT ME!” when hashed?

How can I create a password, which when directly hashed (without any salt) with md5 will return a string containing the 8 characters "SALT ME!". The hope is that a naive developer browsing through his ...
4
votes
4answers
872 views

Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself? [duplicate]

I have moved this question from stackoverflow to this place. I know it may be a question about 'opinion' but I am not looking for a private opinion but a source of the final decision to keep it this ...
0
votes
3answers
117 views

Cryptosytem Question [closed]

A file is encrypted and placed on a secure FTP server. An MD5 hash is taken of the file and also placed on the FTP server. A userlogs in to the server and downloads both files, however, the hash fails ...
1
vote
1answer
171 views

Is using MD5 in NTLMv2 protocol to store Windows passwords is secure?

I read that Windows (probably not new OSs but say, Windows Server 2008) stores passwords using Hashes using NTLMv2 protocol which uses MD5 hash function. My questions: MD5 is known to be insecure ...
3
votes
2answers
1k views

How weak is MD5 as a password hashing function ?

A professor told us today, that MD5 is weak. I understand his chain of thought but pointed out, that IMHO MD5 is a good way to go if you would use a long (even really long) dynamic salts and static ...
0
votes
1answer
142 views

Is it possible to insert data into UUID?

Is it possible to insert arbitrary data into UUID? Let's suppose we have an MD5\SHA hash of something... can we encode that data into a valid UUID?
7
votes
1answer
582 views

Does bcrypt on top of md5 reduce its security?

A GitHub project I recently checked has a flawed security as they're using an unsalted md5() to hash the passwords. I opened a bug and they acknowledged it. However, the transition from md5() to ...
1
vote
1answer
2k views

John the ripper passwd file format with salt not working

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is: $hash = md5($salt . $pass) No other ...
2
votes
1answer
236 views

Unknown encryption string [closed]

I'm trying to learn about encryption and decryption methods when I faced this string: {MD5}JfnnlDI7RTiF9RgfG2JNCw== MD5 is 16-byte string, so anyone know what type of encryption is this and why ...
4
votes
2answers
1k views

Rounds of MD5 and SHA512 Hashing Algorithms

What is the exact number of rounds employed by the MD5 and SHA512 hashing algorithms? According to various sources, the SHA512 hashing algorithm employs a total of 80 rounds ...
0
votes
1answer
275 views

What does it mean by the 'Hash of a malware'?

I have just recently started to delve into the topics of malware. In my hunt for malware binaries, I came across certain responses that it is not easy to grab binaries based on malware names like ...
6
votes
3answers
2k views

How exactly is MD5 vulnerable to collission attacks?

I've often read that MD5 (among other hashing algorithms) is vulnerable to collisions attacks. I understand the collision part: there exist two (or more) inputs such that MD5 will generate the same ...
0
votes
2answers
4k views

If hashing is one way, why can we decrypt MD5 hashes?

I have read some times that hashing is a one way function, that is you can make the hash of a message, but you can't recover the original message from the hash, just check its integrity. However, if ...
3
votes
3answers
530 views

Why are MD5 collisions dangerous?

I understand that the MD5 algorithm isn't collision resistant, and that collisions between data of arbitrary size can be found with more efficient methods than brute-forcing. However, I have read ...
7
votes
2answers
605 views

Does the md5 (or any hash for that matter) of a string include the null terminator?

Does the md5 (or any hash for that matter) of a string include the null terminator in its calculations? That is does the hash of a string equal the hash of the sequence of bytes that represents the ...
5
votes
2answers
1k views

Truncating the output of SHA256 to 128 bits

suppose we need/prefer 128 bit hash output. for example to generate a 128 bit encryption key or, in other applications (e.g. file integrity verifications), to consume less storage space. i don't know ...
7
votes
3answers
547 views

Is Using MD5 Sufficient Reason to Reject This Payment Processor?

I'm evaluating a credit card processor[1], and I noticed they are using MD5 as part of a salted hash algorithm to protect a secret key. Since I know MD5 is generally considered broken, this feels like ...
1
vote
1answer
463 views

what does GUID have that a whirlpool, md5 or sha2 hash dont

I'm trying to understand the use of GUID and what has always left me wondering is what's so special about them that I should consider using them instead of rolling my own type of unique id. In other ...
6
votes
3answers
633 views

NTLMv2 resistance to bruteforcing

I have a question regarding NTLMv2 resistance to password bruteforcing. I know that some modern graphic processors (like Radeon 6990) are able to calculate billions hashes per second and crack NTLM ...
12
votes
7answers
2k views

Why does some popular software still use md5?

Nowadays no one dares to defend md5 for any use, and of course they should not! However, much popular software still uses md5 in applications such as password hashing (although it's not simple/plain ...
1
vote
2answers
230 views

Creating a rainbow table with predefined text

I need to extract a password from a hash. This hash was generated by prepending and appending two different predefined strings to the password: Hash(PredefinedString1+Password+PredefinedString2) ...
0
votes
4answers
527 views

Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?

I am creating a page on a website that will show a user some authorized information from another website, and that website uses a combination of the user's user-number and a secret passphrase hashed ...
0
votes
2answers
1k views

How can I extract the MD5 hash of a password protected MS Office Word 2000 document?

AFAIK, the compound file format identifier is D0 CF 11 E0 A1 B1 1A E1, which is located in the offset 0 of the header, which has a length of exactly 512 bytes. However that is not enough to get the ...
0
votes
3answers
934 views

Why is it necessary to match the checksum of a download with another file provided by the same server? [duplicate]

Possible Duplicate: Does hashing a file from an unsigned website give a false sense of security? On many servers providing files for download, there is a file on which checksums are ...
0
votes
2answers
1k views

Tool for generating MD4 collisions

There are a lot of research papers available online that discuss vulnerabilities of MD4 algorithm, but I couldn't find any implementation of these. Uptill now I have used tools like John the Ripper ...
14
votes
2answers
483 views

Password Salts and Randomness

Alright, so I understand that users are the kind of beasts who like to use one password and make it short and easy to remember (like "doggies"). If I understand correctly, that's one reason we use ...
1
vote
2answers
520 views

Are SIP REGISTER transactions w/ HTTP Digest subject to replay attacks?

It is my understanding that the authentication during a SIP registration is done through some kind of an MD5 hashing algorithm known as HTTP Digest, and doing a tcpdump of the actual traffic I've ...
1
vote
4answers
1k views

Antivirus Engine based MD5 or SHA1 hash?

I'm trying to understand more about MD5 and SHA1 hashes algorithms and their behavior in serious security software(found this but not helped me more). Why does ClamAV use additional scanning ...
0
votes
3answers
488 views

Key stretching an hash

if I implement an function which hashes the first half of my password with MD5 and the second half with SHA2 and MD5. Is there a security issue when I put these two hashes together to a 64 character ...
3
votes
1answer
660 views

Replacing weak SSH fingerprint algorithms

Even though MD5 has been broken for years and its vulnerabilities have been used to create real-world rogue X.509 CAs and other horrible things, OpenSSH and PuTTY still use MD5 as the default public ...
1
vote
0answers
142 views

Finding pre-image of MD5 hash [closed]

I have the following requirement for hashing using MD5. H(A,B,C,X); Where values A,B & C are given. However X is not given. I would like to find out what value of X would give a hash beginning ...
25
votes
3answers
3k views

MD5 collision attacks: are they relevant in password hashing?

DISCLAIMER: This is not an endorsement of MD5 as a password hashing function. I know about parallelization, GPUs, and dedicated password hashing functions like bcrypt and scrypt. With that out of ...
-5
votes
5answers
734 views

create a variants of MD5

I have also asked similar q here : To create a variants of MD5, I made following changes : MD5 uses a non-linear sin(i)* pow(2,32) ----> i plane to use cos(i)*pow(2,32) Instead ...
2
votes
3answers
919 views

Preventing dictionary attacks against hashed passwords [duplicate]

Possible Duplicate: How to securely hash passwords? I have a website and on that website I use SHA-256 and salt my user's passwords. What I'm doing right now is padding each letter of the ...
3
votes
2answers
1k views

Why do most hashing functions produce hashes that have characters a-f 0-9?

This is something I never understood about hashing functions. I know that algorithms like whirlpool and blowfish both produce outputs that don't follow this pattern, but why is it that most do? Is ...