A salt is a random addition to a password to make the hashed password less susceptible to a lookup table attack

learn more… | top users | synonyms

3
votes
1answer
101 views

OS login password: How does it work?

I am making an application to create a password for a user. I am a bit baffled over how it all works though. Namely I want to be sure that my application will store the correct hash so the user can ...
3
votes
2answers
634 views

Determine salt length from hash

I am writing a basic Unix password cracker in Python that would work for MD5, SHA-1 and SHA512. I know that the salt in MD5 correspond to the 2 first chars of the encrypted password, and thus I ...
-4
votes
1answer
41 views

How to find an encryption algorithm between two hexadecimal numbers? [closed]

I have several numbers that are generated by a server. They are 16 digits long and are hexadecimal. I have no idea whether or not any salting or hashing techniques were used. Can I find the encryption ...
4
votes
1answer
78 views

Protect password/authenticating during transit over (insecure) TCP socket for a game

Background I am designing a multi-player game with a single server that handles multiple worlds. Each player logs into the server initially before requesting which world to join. The server has a ...
2
votes
1answer
55 views

Do password derived encryption keys need to be salted?

If I have a database where I store users' sensitive information, and encrypt that information, do I need to do something like PBKDF2(password,salt,10^5) for the encryption key as well as the hash?
2
votes
1answer
111 views

Reverse engineering of a global hash salt from known plaintext and hash

First of all i'm not asking what is a hash, or something else. I will try to explain what i'm searching clearly: Let's say I have a dump of a database, all the passwords of this database are hashed, ...
2
votes
3answers
142 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
3
votes
0answers
45 views

Forcing new password with zero-knowledge proof authentications

Let's say a ZKP (e.g. SRP6a) is used, for password verification. Let's say I need to force a user to change their password (so I have the salt and the verifier for the current password). For this, ...
2
votes
2answers
87 views

Guid salt - string vs bytes[]

Recently I got into passwords hashing (SHA256, HMAC-SHA1, PBKDF2, etc.) and one "statement" I've been reading over and over again, stuck in my mind and I can not find a satisfying answer. "When we ...
5
votes
5answers
2k views

Salted password + hash - is it really useful? [duplicate]

I am new to the topic and wanted to know the concept of having salted hashes before going down to the technical details. From what I have understand password - plaintext hash password - plaintext ...
3
votes
3answers
56 views

where to store the salt for “crypto_pwhash” in a web application with no local storage

I am developing a web application which stores encrypted data on a server. I want to derive the encryption key as well as the login key from a single user password, so I want to use libsodiums ...
2
votes
1answer
95 views

How to implement encrytion/decryption system using IV between mobile app and web service

In my app we are going to send encrypted data to the web service. I am using the following code to encrypt and decrypt the data - public class DecEn { private static final String password = ...
1
vote
1answer
40 views

Can a salt maintain pseudo-randomness after being modified?

TL;DR: How much can a function (such as the one below) modify an initially random string before that string becomes useless as a salt for password hashing? Is there a general rule? # Function ...
0
votes
1answer
54 views

Can you resalt hash/rainbow tables after finding the salt for something?

After a rainbow/hash table is salted, is it possible to resalt it after finding the correct salt instead of generating it all over again? If not, what is preventing you from doing so? How can you find ...
1
vote
1answer
63 views

Using username as salt safe enough? [duplicate]

Instead of creating a separate salt generator for each user, can't I just use their username as a salt? It would be unique for everyone, and achieves the purpose of the salts. <?php ...
6
votes
2answers
218 views

Do I REALLY need to change my LastPass password?

Last weekend LastPass' network was compromised and that a list of email addresses along with the hashes of the master passwords were stolen. It is being recommended that LastPass users change their ...
5
votes
5answers
887 views

How secure is it to keep the salt with the password hash? [duplicate]

In Linux we have the salt just next to the password hash in the /etc/shadows file. I always hear that salt value prevents hashed passwords from being cracked by brute force methods. But if somehow we ...
1
vote
4answers
257 views

Why is a password accompanied by a username deemed 'safer'?

While browsing this community I notice that some people say that the main advantage of usernames accompanied by passwords is as they take more tries to be brute forced, however I don't think that is ...
1
vote
2answers
145 views

Is it possible to crack hash with known salt? If yes how?

Hello folks, I was wondering , if the salt in the hash is known to us,then is it possible to crack to extract the password from the hash? If Yes, How?
3
votes
1answer
142 views

Is this symetric or asymetric encryption?

I’m at the beginning of my journey into the world of security. I am reading about the most fundamentals topics and I have encountered something unusual that has thrown me. The Conundrum: I have come ...
0
votes
1answer
61 views

MySQL Database Password protection

I am developing an industry-level web server that requires that all passwords be encrypted in some way. The middle-ware for the server is Java-based. My only restriction is that I can't use API's ...
2
votes
1answer
130 views

Securely storing passwords using PHP5

Starting note: After going through some articles and answers posted on SO related to storing secured passwords I'm still not sure whether my way of thinking is applicable to todays reality. I'm ...
1
vote
2answers
58 views

Salt addition in hashing? [duplicate]

I may be wrong here but reading about salt I was wondering whether if we use the same salt for every password saved in our database won't users having same password would lead to same hash even after ...
0
votes
0answers
9 views

Does a static salt in addition to a random one add any security? [duplicate]

I'm looking through some old hashing code and found something that made me raise an eyebrow. In order to store passwords, it uses BCrypt to generate a random salt and hash the password. Before that, ...
0
votes
2answers
141 views

Is my hashing function good enough

Is there an obvious flaw with this hashing function (written in PHP)? function hash($password) { sleep(1); // Make hashing slow $hash = ""; $iterations = strlen($password); for ( $i = 0; $i ...
6
votes
3answers
259 views

Image file as password alternative

I seek guidance on interesting issue. Recently I've been searching for password alternatives, not because of the security, but to be more user-friendly. In one of my projects user receives 128 bits ...
4
votes
1answer
614 views

Is it a good idea to use two salts? [duplicate]

Is it a good idea to use two salts? This is implying that one would be unique to the user, and one would be unique to the server, using Bcrypt of course. So for example, if you're using Golang as ...
1
vote
2answers
134 views

Is bruteforcing the last character of a salt a good idea?

Would it be a good idea security-wise to store salts with their last character removed, and then bruteforce the last character to further the amount of time it would take to create rainbow tables and ...
1
vote
2answers
103 views

Hashing password with salt [duplicate]

I read from wiki: The attacker has access to both the hashed password and the salt, so when running the dictionary attack, the attacker can simply use the known salt when attempting to crack the ...
14
votes
6answers
3k views

What are the differences between an encryption seed and salt?

Today I had a hard time explaining the difference to a friend. I know seeds are used when generating "random" strings. And salts are used when providing different outcomes to a hash. What is a ...
1
vote
3answers
105 views

How to compare passwords with duplicate password

On Steam, the gaming client, I have this habit of creating multiple "smurf" accounts. I have a randomly-generated, unique password, and I decided to use the same password for all of my multiple ...
2
votes
1answer
235 views

Crackstation “Secure Salted Password” Java example - is it really secure?

I'm making an auth service so I've been looking for some good Java/Groovy implementations of password + salt hashing. I've found this article on crackstation along with a code example and decided to ...
3
votes
5answers
388 views

Are all unsalted password hashes inherently insecure?

Maybe I'm missing something obvious... Are all passwords stored in common, unsalted hash algorithms able to be attacked via rainbow tables?
3
votes
3answers
289 views

Are credit card number look ups more secure with a hash function than with a deterministic encryption algorithm?

I understand PCI DSS 3.0 allows hashes of cardnumbers to be stored separately from encrypted values, but I'm startled at the efficiency of tools like hashcat in discovering card numbers from hashed ...
1
vote
1answer
73 views

Storing salt and hashed password [duplicate]

Is there a benefit to storing salt appended to hashed password in a single column of a table verses storing salt and hashed password in different columns of the table. The OWASP guide here ...
1
vote
2answers
59 views

One-way function for data synchronisation

I have to synchronise small sets of data between two or more systems over an insecure network. First I have to check that the other system has the same unique identification information for the data ...
11
votes
2answers
1k views

How can I find out the password hashing schemes used by the specific Unix accounts I log in to?

Every day I ssh in to 3 or 4 independent Unix accounts. I have been regarding them as more or less "equivalently secure" on the grounds that I'm using ssh, but after learning of how much variety ...
0
votes
2answers
77 views

Is it safe to use a derivative of a password as a salt

I know for a fact that salts are an important part of storing a password securely in a database. Most people store the password hash, and the salt that was used for it. This, I have learned, isn't ...
0
votes
2answers
134 views

Separate database column for salt

Is it advisable to store the salt in a separate database column or should we concatenate it together with the password? Is there any difference? I have come across implementations of both types. ...
0
votes
0answers
79 views

Suggestion of encrypt method for short fixed size result

I'm searching for a encrypt method that receives an int variable and outputs exactly 11 hexadecimal digits. I'm starting on a existing application, that already has a database of more than 130.000 ...
0
votes
3answers
127 views

Creating user and safely sending password

Assuming I currently use a safe way to salt-challenge-response-authentication-method, passwords are stored secured and all. I now question myself - how do users set the password? Meaning, they enter ...
2
votes
2answers
567 views

PBKDF2: can the salt be known from the hash?

I understand that some KDFs bundle the salt with the output, such as bcrypt (modular crypt format). In PKCS5_PBKDF2_HMAC (specifically, looking at OpenSSL implementation) with a single iteration, is ...
1
vote
0answers
101 views

Why do we need salt and RFC in generating AES encrypted message

I'm not very familiar with encryption and new to this, I'm just learning it right now by code review of one of the class we have in an application to encrypt a password using AES. Would anyone explain ...
20
votes
5answers
4k views

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...
3
votes
1answer
495 views

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

This is going to get long, so prepare. Basis of the question is, Do all these steps improve security, or am I completely overthinking the problem? Are my assumptions/thought process valid? We all ...
5
votes
2answers
818 views

Can the IV + Salt be the same?

During my encryption app i've got the password creation bit: PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 10000, keyLength); and later on the actual encryption part: ...
8
votes
5answers
2k views

Should I remotely store my salt? [duplicate]

When users register on my site, I want to store their username and hashed password in my database. When I hash that password, I'm going to salt it using PHP. The issue is, I don't want to store the ...
5
votes
2answers
810 views

Authentication: Username (email) and password hashed together in one database field

I am currently developping a platform with a PHP framework for our client. The head of the client's IT department wants us to handle authentication with one database field containing ...
1
vote
2answers
201 views

Is it a good idea to use the user's username as a salt when hashing a password like hash(username_str + password_str)?

I'm helping my friend with hashing his passwords, and I've a question - Should he use one secret string as salt for hashing or is it better to have each user its own salt for hashing? Consider these ...
-2
votes
3answers
412 views

My friend hashes passwords with SHA512 algorithm without salt. How do I convince him that he needs to add salt?

Today I discovered something incredibly stupid - my friend hashes user passwords with sha512 algorithm without a salt. I immediately raised this issue to him but he said he wants to see anyone crack a ...