a cryptographic hash function with a 128-bit (16-byte) output, now deprecated

learn more… | top users | synonyms

0
votes
1answer
174 views

Is it possible to insert data into UUID?

Is it possible to insert arbitrary data into UUID? Let's suppose we have an MD5\SHA hash of something... can we encode that data into a valid UUID?
0
votes
1answer
283 views

MD5 Algorithms in web development

I am storing the passwords of my college website in our own server. I am storing the passwords using the MD5 encryptor. But the doubt I got is since the decrypter is there I can also decrypt the ...
0
votes
1answer
278 views

company is sending md5 string via GET['password'] dangerous?

So, this big, reknown company (you all heard off) is sending md5 encrypted strings (with GET key: password) over HTTP. I accidentally came over it since I wanted to use jnlp on a non-windows ...
7
votes
1answer
950 views

Does bcrypt on top of md5 reduce its security?

A GitHub project I recently checked has a flawed security as they're using an unsalted md5() to hash the passwords. I opened a bug and they acknowledged it. However, the transition from md5() to ...
4
votes
2answers
1k views

Is HTTP Digest + MD5 still an alternative to consume my own api?

I'm reading a lot about implementing security constraints to a REST API. There are a lot of methods, some better than others for 3party applications or to consume my own API. HTTP Basic + TLS (with ...
1
vote
1answer
4k views

John the ripper passwd file format with salt not working

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is: $hash = md5($salt . $pass) No other ...
3
votes
2answers
691 views

Does PCI ban using MD5 to store sensitive data?

Just had a vendor tell me that because their PCI auditors did not recommend banning the use of unsalted MD5 to store sensitive data at this time with with their current level of PCI compliance that ...
8
votes
1answer
1k views

Is Postgres password-based authentication secure?

According to Postgres's documentation, Postgres's password authentication method uses MD5 hashing to secure the password: The password-based authentication methods are md5 and password. These ...
2
votes
1answer
273 views

Unknown encryption string [closed]

I'm trying to learn about encryption and decryption methods when I faced this string: {MD5}JfnnlDI7RTiF9RgfG2JNCw== MD5 is 16-byte string, so anyone know what type of encryption is this and why ...
-4
votes
1answer
83 views

What is wrong with those calculations md5 gpubruteforcing

I read an article by a stackexchange founder: http://www.codinghorror.com/blog/2012/04/speed-hashing.html It talks about: " two ATI Radeon 7970 cards generating nearly 16000 M c/s with MD5." " the ...
-4
votes
1answer
347 views

Encryption algorithm encryptable by md5 of key and decryptable by key [closed]

Is it possible to make an encryption algorithm that can be encrypted by the md5(or any other one way encryption algorithm) of the key and decrypted by the key? The purpose of this would be for the ...
4
votes
2answers
2k views

Rounds of MD5 and SHA512 Hashing Algorithms

What is the exact number of rounds employed by the MD5 and SHA512 hashing algorithms? According to various sources, the SHA512 hashing algorithm employs a total of 80 rounds ...
0
votes
1answer
446 views

What does it mean by the 'Hash of a malware'?

I have just recently started to delve into the topics of malware. In my hunt for malware binaries, I came across certain responses that it is not easy to grab binaries based on malware names like ...
3
votes
1answer
448 views

MD4 or MD5 speed depends on data or just on data size?

Im just wondering ... Lets say, I want to compute an MD5 hash from a given buffer which is an empty (memset(buffer, ' ', sizeof(buffer));) buffer with size of 512. I also want to compute MD5 hash on ...
7
votes
3answers
4k views

How exactly is MD5 vulnerable to collission attacks?

I've often read that MD5 (among other hashing algorithms) is vulnerable to collisions attacks. I understand the collision part: there exist two (or more) inputs such that MD5 will generate the same ...
0
votes
2answers
8k views

If hashing is one way, why can we decrypt MD5 hashes?

I have read some times that hashing is a one way function, that is you can make the hash of a message, but you can't recover the original message from the hash, just check its integrity. However, if ...
3
votes
3answers
851 views

Why are MD5 collisions dangerous?

I understand that the MD5 algorithm isn't collision resistant, and that collisions between data of arbitrary size can be found with more efficient methods than brute-forcing. However, I have read ...
2
votes
2answers
2k views

What exactly is 'single' mode in John the Ripper doing?

I'm testing out John the Ripper (1.7.9 Jumbo 7) on a file containing MD5 hashes without any usernames. I've been experimenting with different rules and configurations – I am currently using a wordlist ...
7
votes
2answers
1k views

Does the md5 (or any hash for that matter) of a string include the null terminator?

Does the md5 (or any hash for that matter) of a string include the null terminator in its calculations? That is does the hash of a string equal the hash of the sequence of bytes that represents the ...
0
votes
1answer
2k views

Using JTR to crack Skype Passwords

The scenario: coworker's Skype somehow lost his auto-fill password. He doesn't remember it anymore, and the account is hooked up to an email address that no longer exists. He's never purchased any ...
6
votes
2answers
2k views

Truncating the output of SHA256 to 128 bits

suppose we need/prefer 128 bit hash output. for example to generate a 128 bit encryption key or, in other applications (e.g. file integrity verifications), to consume less storage space. i don't know ...
7
votes
3answers
651 views

Is Using MD5 Sufficient Reason to Reject This Payment Processor?

I'm evaluating a credit card processor[1], and I noticed they are using MD5 as part of a salted hash algorithm to protect a secret key. Since I know MD5 is generally considered broken, this feels like ...
5
votes
3answers
2k views

Using MD5 for file integrity checks?

General Always check the MD5 hashes of the .NET Framework assemblies to prevent the possibility of rootkits in the framework. Altered assemblies are possible and simple to produce. Checking ...
2
votes
1answer
891 views

what does GUID have that a whirlpool, md5 or sha2 hash dont

I'm trying to understand the use of GUID and what has always left me wondering is what's so special about them that I should consider using them instead of rolling my own type of unique id. In other ...
3
votes
1answer
904 views

How does VTP authentication prevent unauthorized access (Can the password be cracked given captured packets)

I know that when setting up VTP across switches in a network you should set a secret/password to prevent unauthorized requests. My question is I know that this uses an MD5 hash to ensure that ...
6
votes
3answers
1k views

NTLMv2 resistance to bruteforcing

I have a question regarding NTLMv2 resistance to password bruteforcing. I know that some modern graphic processors (like Radeon 6990) are able to calculate billions hashes per second and crack NTLM ...
15
votes
7answers
3k views

Why does some popular software still use md5?

Nowadays no one dares to defend md5 for any use, and of course they should not! However, much popular software still uses md5 in applications such as password hashing (although it's not simple/plain ...
1
vote
2answers
293 views

Creating a rainbow table with predefined text

I need to extract a password from a hash. This hash was generated by prepending and appending two different predefined strings to the password: Hash(PredefinedString1+Password+PredefinedString2) ...
0
votes
4answers
823 views

Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?

I am creating a page on a website that will show a user some authorized information from another website, and that website uses a combination of the user's user-number and a secret passphrase hashed ...
0
votes
2answers
2k views

How can I extract the MD5 hash of a password protected MS Office Word 2000 document?

AFAIK, the compound file format identifier is D0 CF 11 E0 A1 B1 1A E1, which is located in the offset 0 of the header, which has a length of exactly 512 bytes. However that is not enough to get the ...
2
votes
3answers
2k views

Why is it necessary to match the checksum of a download with another file provided by the same server? [duplicate]

Possible Duplicate: Does hashing a file from an unsigned website give a false sense of security? On many servers providing files for download, there is a file on which checksums are ...
0
votes
2answers
2k views

Tool for generating MD4 collisions

There are a lot of research papers available online that discuss vulnerabilities of MD4 algorithm, but I couldn't find any implementation of these. Uptill now I have used tools like John the Ripper ...
14
votes
2answers
534 views

Password Salts and Randomness

Alright, so I understand that users are the kind of beasts who like to use one password and make it short and easy to remember (like "doggies"). If I understand correctly, that's one reason we use ...
1
vote
2answers
723 views

Are SIP REGISTER transactions w/ HTTP Digest subject to replay attacks?

It is my understanding that the authentication during a SIP registration is done through some kind of an MD5 hashing algorithm known as HTTP Digest, and doing a tcpdump of the actual traffic I've ...
1
vote
4answers
2k views

Antivirus Engine based MD5 or SHA1 hash?

I'm trying to understand more about MD5 and SHA1 hashes algorithms and their behavior in serious security software(found this but not helped me more). Why does ClamAV use additional scanning ...
1
vote
3answers
721 views

Key stretching an hash

if I implement an function which hashes the first half of my password with MD5 and the second half with SHA2 and MD5. Is there a security issue when I put these two hashes together to a 64 character ...
4
votes
1answer
1k views

Replacing weak SSH fingerprint algorithms

Even though MD5 has been broken for years and its vulnerabilities have been used to create real-world rogue X.509 CAs and other horrible things, OpenSSH and PuTTY still use MD5 as the default public ...
1
vote
0answers
164 views

Finding pre-image of MD5 hash [closed]

I have the following requirement for hashing using MD5. H(A,B,C,X); Where values A,B & C are given. However X is not given. I would like to find out what value of X would give a hash beginning ...
28
votes
3answers
4k views

MD5 collision attacks: are they relevant in password hashing?

DISCLAIMER: This is not an endorsement of MD5 as a password hashing function. I know about parallelization, GPUs, and dedicated password hashing functions like bcrypt and scrypt. With that out of ...
5
votes
2answers
2k views

Do Client Nonces enhance the security of HTTP Digest Auth?

As far as I understand the answer at http://security.stackexchange.com/a/3024/13447, client nonces are meant to prevent attackers from amortizing the costs of brute-force hash computations by being ...
1
vote
1answer
912 views

cracking MD5 with salt using JTR

In a legal, learning context at school, we have to understand security in Linux in the /ect/shadow file and the anaconda-ks.cfg. These two files contains often different kind of hash and the password ...
-6
votes
5answers
893 views

create a variants of MD5

I have also asked similar q here : To create a variants of MD5, I made following changes : MD5 uses a non-linear sin(i)* pow(2,32) ----> i plane to use cos(i)*pow(2,32) Instead ...
2
votes
3answers
1k views

Preventing dictionary attacks against hashed passwords [duplicate]

Possible Duplicate: How to securely hash passwords? I have a website and on that website I use SHA-256 and salt my user's passwords. What I'm doing right now is padding each letter of the ...
4
votes
2answers
2k views

Why do most hashing functions produce hashes that have characters a-f 0-9?

This is something I never understood about hashing functions. I know that algorithms like whirlpool and blowfish both produce outputs that don't follow this pattern, but why is it that most do? Is ...
3
votes
2answers
1k views

Program binaries or files with same MD5 hash

I'm looking for 2 different program binaries or 2 different files with the same MD5 hash to prove its weakness and the collisions in the algorithm.
4
votes
1answer
988 views

Code signing with MD5 on Windows 8

I discovered that a signed installer package that is reported as correctly signed on Windows 7 and earlier, is reported as "corrupt" in IE10 on Windows 8. Further investigation showed that the ...
-2
votes
0answers
116 views

Varient of MD5 and SHA [duplicate]

Possible Duplicate: Generating random numbers with repeated hashing, but without using a standard hash function I need a new mechanism to create Random Number Generate(RNG). In which ...
16
votes
6answers
14k views

Is MD5 considered insecure?

After all these articles circulating online about md5 exploits, I am considering switching to another hash algorithm. As far as I know it's always been the algorithm of choice among numerous DBAs. Is ...
36
votes
3answers
76k views

Is SHA1 better than md5 only because it generates a hash of 160 bits?

It is well known that SHA1 is recommended more than md5 for hashing since md5 is practically broken as lot of collisions have been found. With the birthday attack, it is possible to get a collision ...
-1
votes
1answer
740 views

Please tell me two strings which have the same MD5 hash value

Yes, I know MD5 is weak and should not be used. To make a prove of concept I need two strings with the same MD5 value but all I can find is binary. Like this nice example. Works fine as binary but ...