a cryptographic hash function with a 128-bit (16-byte) output, now deprecated

learn more… | top users | synonyms

0
votes
0answers
50 views

What kind of hash is in JSON of “Bing image of the day”

I just found the JSON output of Bing image of the day. Here it is: http://www.bing.com/HPImageArchive.aspx?format=js&idx=0&n=1&mkt=en-US I saw a hsh JSON object, and after I checked ...
0
votes
0answers
7 views

Insecure data in-transit

My organization processes some PII data and shares it with an outbound connection (outflow only) that is a third party. The data transfer transactions occur without human intervention. That outbound ...
1
vote
1answer
30 views

Possible number of collisions in a hashing function with constant message size

Jumping to conclusions from my question, can we predict possible number of collisions for a given message in a given hashing algorithm. Say I am using SHA-1 which outputs 160 characters string, and ...
-1
votes
1answer
57 views

Shouldn't multiple images always exist even in most powerful hashing algorithm?

I have a confusion in mind that since in hashing we transform a large string into a smaller fixed size string, so its unlikely that any large string has a unique hash. There had to be collisions and ...
50
votes
4answers
111k views

Is SHA1 better than md5 only because it generates a hash of 160 bits?

It is well known that SHA1 is recommended more than md5 for hashing since md5 is practically broken as lot of collisions have been found. With the birthday attack, it is possible to get a collision ...
0
votes
0answers
4 views

Get secret_value from multiple hashes md5(known_value_n + secret_value) [migrated]

The attacker knows multiple hashes like md5(known_value_n + secret_value), for multiple known values. Does it help him to discover secret_value better then just single md5(known_value + secret_value)? ...
0
votes
1answer
69 views

Why file hosting sites never ban files using MD5 hash? [closed]

We have beautiful technology called MD5 Hash for banning files, then why file hosting sites never implement this thing on DMCA files?
4
votes
1answer
135 views

Is the 64-bits length of the original string padded as well in the MD5 hashfunction?

So, for example I have a string which binary value is exactly 512 - 64 bits long, so the binary conversion of the string does not have to be padded. So that means I have a string of 56 chars. The ...
0
votes
0answers
11 views

Using application that uses MD5 with FIPS 140-2

I am using ecryptfs for disk encryption which uses MD5. However I also have requirement to be FIPS 140-2 enabled which blocks MD5. My question is, without modifying ecryptfs is there a way I can get ...
1
vote
2answers
74 views

Is it possible to find the salt?

I have this PHP code with me : $auth = md5($username.$password.$salt); I have a dummy value : $username = user $password = password And I also have the resulting MD5 Hash : ...
5
votes
2answers
166 views

Migrating password db off MD5 by chaining MD5 and Bcrypt?

I have a legacy system currently storing unsalted MD5 passwords. Unfortunately, some other controls are not in place (like the ability to expire passwords) and I'm trying to upgrade my algorithm to ...
3
votes
1answer
102 views

Md5 vs Md4 recognition

Is there a way to actually find out whether a hash is MD5 or MD4? For instance: 10c7ccc7a4f0aff03c915c485565b9da is an MD5 hash be08c2de91787c51e7aee5dd16ca4f76 is an MD4 hash I know that there ...
0
votes
1answer
1k views

Security weaknesses in using RSA encrypted MD5 hash of certificate content

Suppose you have an Internet banking site based on a secure web server running the HTTPS protocol via port 443. The server authenticates itself to clients through an X.509 certificate signed by a ...
10
votes
2answers
13k views

How weak is MD5 as a password hashing function ?

A professor told us today, that MD5 is weak. I understand his chain of thought but pointed out, that IMHO MD5 is a good way to go if you would use a long (even really long) dynamic salts and static ...
3
votes
2answers
121 views

Is signing android apk file with SHA1 digest secure enough?

Google command line example for signing apk files: $ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name source: ...
2
votes
1answer
275 views

Best way to encrypt data using php - I am not sure if I doing it correctly [duplicate]

I want to encrypt some data within my php file when I add the stuff to my mysql database. This is how I do it. I create a static key like: $key = md5("pass"); Then I have two functions called ...
3
votes
1answer
137 views

MD5 Algorithm: A basic explanation of the process

Could anyone please explain the basic idea and steps involved in the MD5 algorithm? I tried reading it on the web (Wikipedia etc.), but it was just too high level for me. So, can someone explain the ...
-5
votes
1answer
86 views

What kind of base64 it is? [closed]

So I have a string that is 123456 then I md5 it and now I have hash e10adc3949ba59abbe56e057f20f883e then I don't know what kind of base64 (this is my thought about base64, mb its not base64 ...
3
votes
1answer
97 views

Why are weak Cipher Suites still in use by clients, particularly mobile apps?

I am examining the collection of cipher suites that some mobile apps use (Client Hello) and I noticed that the majority of them include the TLS_RC4_128_MD5 and TLS_RC4_128_SHA. According to the OWASP ...
2
votes
1answer
154 views

Is possible to force a file to generate an specific MD5 signature?

Sometimes MD5 is used to validate that a downloaded file is really valid. So I want to know if is possible for a hacker to modify a file and introduce some malicious code AND make that file generate ...
25
votes
4answers
6k views

Why are MD5 and SHA-1 still used for checksums and certificates if they are called broken?

I was just reading about SSL/TLS stuff, and according to this site (which is rated as A by Qualys SSL Labs), MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And yet, I noticed ...
-7
votes
2answers
5k views

Is AES slower to encrypt than MD5?

Is this the right interperation of this diagram: http://www.cryptopp.com/benchmarks.html AES/CCM MiB/Second:61 Cycles Per Byte:28.6 MD5 MiB/Second:255 Cycles Per Byte:6.8 And does that ...
-7
votes
2answers
211 views

What is is the best way to create virus signature database? [closed]

We are thinking to develop a new Antivirus program. The main concern is to create a virus signature database. I want to ask what is the best possible way to add viruses signature in our database to ...
1
vote
0answers
39 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
-1
votes
2answers
131 views

Decrypting a very simple key [closed]

I'm doing a basic cryptography course and a question is asking to to decipher: ...
3
votes
2answers
123 views

Are there any known MD5 hash collisions of messages of different length?

All the examples of MD5 hash collisions I've come across comprise two different messages (inputs) of the same length. The first and second messages have different values for a number of bits and the ...
5
votes
2answers
1k views

Code signing with MD5 on Windows 8

I discovered that a signed installer package that is reported as correctly signed on Windows 7 and earlier, is reported as "corrupt" in IE10 on Windows 8. Further investigation showed that the ...
4
votes
1answer
766 views

Cracking DES(Unix)/MD5 ARP

This is a basic example of an Unix Pass Encryption. I have a little Hash of MD5 ARP: user50:$apr1$w7YNTrjQ$0/71H7ze5o9/jCnKLt0mj0 user60:$apr1$AIw2h09/$Ti0TRlU9mDpCGm5zg.ZDP. I need to find the ...
4
votes
1answer
187 views

X.509 Certificate Signature Collision Vulnerability

Customer complained that during security scan performed on our application the following was raised: 172.22.0.19 - xxxxx - IETF X.509 Certificate Signature Collision Vulnerability - ...
34
votes
4answers
4k views

Does every hash value have an inverse value?

There are many different hash functions, md5, sha, and others. They take a value V and produce a H via transformation Function(V) = H, where Function is md5, sha, etc. My question is: Does every hash ...
2
votes
1answer
114 views

Flaw in HTTP Digest Authentication

I am working through my textbook and I came across this question: Below is the message format for a browser response to access a password-protected web page using HTTP digest authentication. GET URI ...
0
votes
1answer
195 views

How can I detect if hashes are salted? [duplicate]

Is it possible to detect hash function of a hash if I don't have access to PHP code? I know that if a hash is some kind of MD5, but I don't know if there is salt etc.
3
votes
2answers
2k views

What does GUID have, that a Whirlpool, MD5 or SHA-2 hash don't?

I'm trying to understand the use of GUID and what has always left me wondering is what's so special about them that I should consider using them instead of rolling my own type of unique ID. In other ...
2
votes
3answers
11k views

Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself? [duplicate]

I have moved this question from stackoverflow to this place. I know it may be a question about 'opinion' but I am not looking for a private opinion but a source of the final decision to keep it this ...
11
votes
3answers
2k views

Is Postgres password-based authentication secure?

According to Postgres's documentation, Postgres's password authentication method uses MD5 hashing to secure the password: The password-based authentication methods are md5 and password. These ...
0
votes
2answers
16k views

If hashing is one way, why can we decrypt MD5 hashes?

I have read some times that hashing is a one way function, that is you can make the hash of a message, but you can't recover the original message from the hash, just check its integrity. However, if ...
34
votes
7answers
29k views

Is MD5 considered insecure?

After all these articles circulating online about md5 exploits, I am considering switching to another hash algorithm. As far as I know it's always been the algorithm of choice among numerous DBAs. Is ...
2
votes
1answer
98 views

Is MD5 ok to use if salted?

This post: http://www.gaiaonline.com/journal/?mode=view&post_id=19734573&u=8357925 Said that salted MD5 is ok but regular MD5 would not be ok. I am a bit confused about this and would ...
-2
votes
1answer
113 views

How MD5 and salt algorithms come into play if the attacker uses curl?

When the user logs into any site, they supply a username ('user01') and password ('password123') into a form then submit. The user has no idea what their hashed password value is that is stored in the ...
1
vote
2answers
87 views

Do you need to check the entire md5 hash value

Is there any likelyhood that two different versions of the same file will produce the same characters at the start of the hash and at the end of the hash (say, the first/last five characters) - is it ...
4
votes
1answer
211 views

Why is Windows password security designed this way? [duplicate]

Let's start with the LM hash. The LanMan hash had MONUMENTAL security flaws, like the password being case insensitive (converted to upper), which reduced the keyspace for a brute force attack. On top ...
5
votes
2answers
584 views

Why not slightly modify an existing hashfunction to create your own? [duplicate]

I read this interesting question on why improvising your own Hash function out of existing hash functions is bad. However this is specifically focusing on 'mixing' existing hashfunctions. What if for ...
-3
votes
1answer
94 views

Hash regex for malware recognition [closed]

I'm looking to store two types of hashes for recognizing blacklisted code. These are the FireEye "import hash" (or imphash) and the ssdeep "fuzzy hash". Is there a regex (or formal documentation) I ...
2
votes
1answer
588 views

Can I know somehow if my password hash is known?

Is there a secure way to know if my password's hash is publicly known on the internet? First I tried to search for it in Hashes.org (http://hashes.org/search.php), but then I suspected, that if it ...
4
votes
3answers
149 views

Can a file have the same MD5SUM but different SHA-1 results from different tools?

I have one file. SHA-1 and MD5 have been generated long time back. I do not know which tool has been earlier. Recently I generated SHA-1 & MD5 for the same JAR. Surprisingly I found that MD5 is ...
24
votes
1answer
2k views

How can the content of a file refer to its own MD5?

So I just saw this picture on Imgur: http://imgur.com/gxRCrCM The intriguing thing about it is that the picture refers to an old Daft Punk song named "Face 2 Face". The image's MD5 is ...
2
votes
3answers
361 views

Hashing passwords in OpenLDAP

I've seen a few posts on the internet saying most people store user passwords in OpenLDAP using one of OpenLDAP's many, built-in hashing functions. But OpenLDAP itself recommends handing off password ...
1
vote
1answer
69 views

Are multiple applications of a salted Linux MD5 hash easier to break than one? [duplicate]

I hashed the same password a lot of times (approximatively 1000 times) using the salted Linux MD5 format. I want to know if it's easier to recover the clear password or not. Is there something that ...
4
votes
2answers
2k views

What's the purpose of $LoginKey from the Ashley Madison leak?

According to this site Ashley Madison was keeping an insecure hash stored in their database using MD5, in addition to the far more secure bcrypt hash. This group used the MD5 hashes to quickly crack ...
2
votes
2answers
251 views

MD5 brute force on a faulty hash?

MD5 for passwords is considered insecure due to the ability to brute force and pick up the result. But what if I change some characters of an MD5 hash and I keep a record of that change so that ...