A salt is a random addition to a password to make the hashed password less susceptible to a lookup table attack

learn more… | top users | synonyms

0
votes
2answers
99 views

Can we store sensitive client information with the admins without them(admins) identifying it?

I am trying to design a pairing application for my university this valentine. How is it supposed to work, you ask?? The clients will submit preferences specifically names to the server and after some ...
0
votes
3answers
64 views

How to use password salt the right way [duplicate]

I understand the basic idea of password salts. You generate a 'random' string of data prepend this data to a user password store password and salt (salt maybe even in 'clear' form) Like in the ...
-2
votes
0answers
47 views

Retrieve original password from hashed password (without salt)

Assume the victim is a who did not use salt to hash the stored passwords. Somehow let's say I steal some passwords from the database. As an attacker, is it a good a approach to create a dictionary ...
4
votes
1answer
79 views

How unique should I make my SSID?

Some say that a 32-character random string is a good idea for SSID names: Treat your WiFi network name as you would a password. Make it complex and avoid using any whole words. Maximum length for ...
0
votes
1answer
34 views

Salt generation for stream cypher

Sorry if this is an elementary question but I could not find a direct answer. For end-to-end encryption of messages that wait temporarily on a server and where the sizes can vary from just a few ...
6
votes
1answer
49 views

Using AES with same salt / IV - required for pattern matching algorithm

I need to securely encrypt data we are storing, but for each client I need the same plaintext to encrypt into the same cypher text. The reason for this is the data is still required for a pattern ...
-1
votes
2answers
56 views

How secure is a hash + reverse(hash)?

From what I know there is a method called salt added to hashes in order to prevent attackers from using pre-computed hashes. As long as the attacker can find a static salt in reverse hashing and do a ...
3
votes
2answers
182 views

Hashing password multiple times with different random salts

I have read a lot of answers about this topic like: https://programmers.stackexchange.com/questions/115406/is-it-more-secure-to-hash-a-password-multiple-times. ...
0
votes
3answers
87 views

Is it OK to reuse the same SALT key across multiple deployments?

We are building a base application that needs to encrypt SSN, DOB, etc... The application is deployed to many customers. Is it "OK" to use the same SALT key for the AES encryption/decryption ?
0
votes
1answer
113 views

How can I detect if hashes are salted? [duplicate]

Is it possible to detect hash function of a hash if I don't have access to PHP code? I know that if a hash is some kind of MD5, but I don't know if there is salt etc.
3
votes
1answer
63 views

Does salt increase security if there is only a single hashed password?

Say there is only a single hashed password in the passwords file. If it was salted, would that make it more secure? My logic is: Yes because SALT helps protect against rainbow tables and dictionary ...
41
votes
12answers
10k views

Is there any real value in hashing/salting passwords?

I look after a system which holds a lot of "low grade" information, nothing financial but name/address/email etc. Someone has suggested that we up the security from the current in house password ...
-2
votes
1answer
100 views

How MD5 and salt algorithms come into play if the attacker uses curl?

When the user logs into any site, they supply a username ('user01') and password ('password123') into a form then submit. The user has no idea what their hashed password value is that is stored in the ...
3
votes
1answer
125 views

Use salt as identifier for crypted session id in database based authentication system for webapp

I have written a database-based authentication framework for webapps I am planning to program in the future. The framework is implemented by using the plpgsql-language of a PostgreSQL-Database and ...
5
votes
1answer
89 views

Salting/Hashing a password

I don't have a security background, so I'm not sure on the best approach for this, I'm developing an android app which users will need to login to (all local). I'm going to store the password in a ...
3
votes
1answer
49 views

secure user authertication

Here : Help understanding basic user authentication with salts and hashing They explain it pretty well, but i'm still struggling to understand this one part... Now, when a user comes to log in ...
1
vote
1answer
102 views

best practices for storing retrievable passwords

I am trying to build a NMS (network management system) and I am required to store passwords for 3rd party databases, devices and servers that are being managed (not user passwords). These passwords ...
-2
votes
1answer
65 views

Finding the cryptographic hashing algorithm, given the plain text and the corresponding salted hash [duplicate]

I have a salted hash (say about, 110 characters long) and the corresponding plain text that I used for hashing. As the title says, is it possible to do find the algorithm via crypt-analysis? What is ...
0
votes
1answer
56 views

Store Hash and/or Encryption salts in database [duplicate]

I am doing a custom login for practice purposes, and i am wondering what would be the logical way to save the hashed password and the salts. Salt/Hash operations are using Rfc2898DeriveBytes class. ...
2
votes
2answers
836 views

Is it possible to salt the SHA1 or SHA256 hash function of OpenSSL?

I would like to salt the hash function of OpenSSL external, so that I can assign a salt on my own. Is that possible or is the hash function of OpenSSL alsways internal "salted"?
3
votes
1answer
153 views

Challenge: How to find the secret key in homebrew MAC/keyed hash: sha1(key + cookie)?

I am trying to solve a security challenge on a website. Basically, the website computes sha1(key + cookie) to sign a cookie so that the user can't change it himself, and to accomplish the goal you ...
3
votes
1answer
515 views

Correct way to generate password salts in PHP 5.3 on Linux given my constraints?

In examining our database storage of hashed passwords with salts, I note a high rate of salt collisions, i.e., there are far too many cases where two table rows have the same salt stored. One ...
4
votes
2answers
127 views

What is the etymology of “Salt” in relation to password storage?

Simple question: When talking about appending a random string to a password before hashing in order to defend against dictionary attacks, we call it a salt. Why do we call it a salt?
17
votes
1answer
2k views

Password hashing : Using 2 salts [duplicate]

I'm developing an authentication service. I know the practice of generating a unique salt per user, stored in the DB with the hashed password, to prevent rainbow tables attacks. I just had the idea ...
0
votes
1answer
151 views

Is it possible to find out the salt of a MD5 hash?

I want to know whether it is possible to find out the salt of a MD5 hash? For instance we've got two MD5 hashes helloworld -> fc5e038d38a57032085441e7fe7010b0 goodbyeworld -> ...
3
votes
1answer
119 views

OS login password: How does it work?

I am making an application to create a password for a user. I am a bit baffled over how it all works though. Namely I want to be sure that my application will store the correct hash so the user can ...
3
votes
2answers
665 views

Determine salt length from hash

I am writing a basic Unix password cracker in Python that would work for MD5, SHA-1 and SHA512. I know that the salt in MD5 correspond to the 2 first chars of the encrypted password, and thus I ...
-4
votes
1answer
62 views

How to find an encryption algorithm between two hexadecimal numbers? [closed]

I have several numbers that are generated by a server. They are 16 digits long and are hexadecimal. I have no idea whether or not any salting or hashing techniques were used. Can I find the encryption ...
4
votes
1answer
111 views

Protect password/authenticating during transit over (insecure) TCP socket for a game

Background I am designing a multi-player game with a single server that handles multiple worlds. Each player logs into the server initially before requesting which world to join. The server has a ...
2
votes
1answer
65 views

Do password derived encryption keys need to be salted?

If I have a database where I store users' sensitive information, and encrypt that information, do I need to do something like PBKDF2(password,salt,10^5) for the encryption key as well as the hash?
2
votes
1answer
202 views

Reverse engineering of a global hash salt from known plaintext and hash

First of all i'm not asking what is a hash, or something else. I will try to explain what i'm searching clearly: Let's say I have a dump of a database, all the passwords of this database are hashed, ...
2
votes
3answers
179 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
7
votes
1answer
107 views

Forcing new password with zero-knowledge proof authentications

Let's say a ZKP (e.g. SRP6a) is used, for password verification. Let's say I need to force a user to change their password (so I have the salt and the verifier for the current password). For this, ...
2
votes
2answers
142 views

Guid salt - string vs bytes[]

Recently I got into passwords hashing (SHA256, HMAC-SHA1, PBKDF2, etc.) and one "statement" I've been reading over and over again, stuck in my mind and I can not find a satisfying answer. "When we ...
5
votes
5answers
2k views

Salted password + hash - is it really useful? [duplicate]

I am new to the topic and wanted to know the concept of having salted hashes before going down to the technical details. From what I have understand password - plaintext hash password - plaintext ...
3
votes
3answers
70 views

where to store the salt for “crypto_pwhash” in a web application with no local storage

I am developing a web application which stores encrypted data on a server. I want to derive the encryption key as well as the login key from a single user password, so I want to use libsodiums ...
2
votes
1answer
330 views

How to implement encrytion/decryption system using IV between mobile app and web service

In my app we are going to send encrypted data to the web service. I am using the following code to encrypt and decrypt the data - public class DecEn { private static final String password = ...
1
vote
1answer
41 views

Can a salt maintain pseudo-randomness after being modified?

TL;DR: How much can a function (such as the one below) modify an initially random string before that string becomes useless as a salt for password hashing? Is there a general rule? # Function ...
0
votes
1answer
67 views

Can you resalt hash/rainbow tables after finding the salt for something?

After a rainbow/hash table is salted, is it possible to resalt it after finding the correct salt instead of generating it all over again? If not, what is preventing you from doing so? How can you find ...
1
vote
1answer
78 views

Using username as salt safe enough? [duplicate]

Instead of creating a separate salt generator for each user, can't I just use their username as a salt? It would be unique for everyone, and achieves the purpose of the salts. <?php ...
6
votes
2answers
269 views

Do I REALLY need to change my LastPass password?

Last weekend LastPass' network was compromised and that a list of email addresses along with the hashes of the master passwords were stolen. It is being recommended that LastPass users change their ...
5
votes
5answers
993 views

How secure is it to keep the salt with the password hash? [duplicate]

In Linux we have the salt just next to the password hash in the /etc/shadows file. I always hear that salt value prevents hashed passwords from being cracked by brute force methods. But if somehow we ...
2
votes
4answers
292 views

Why is a password accompanied by a username deemed 'safer'?

While browsing this community I notice that some people say that the main advantage of usernames accompanied by passwords is as they take more tries to be brute forced, however I don't think that is ...
1
vote
2answers
616 views

Is it possible to crack hash with known salt? If yes how?

Hello folks, I was wondering , if the salt in the hash is known to us,then is it possible to crack to extract the password from the hash? If Yes, How?
3
votes
1answer
155 views

Is this symetric or asymetric encryption?

I’m at the beginning of my journey into the world of security. I am reading about the most fundamentals topics and I have encountered something unusual that has thrown me. The Conundrum: I have come ...
0
votes
1answer
71 views

MySQL Database Password protection

I am developing an industry-level web server that requires that all passwords be encrypted in some way. The middle-ware for the server is Java-based. My only restriction is that I can't use API's ...
3
votes
1answer
218 views

Securely storing passwords using PHP5

Starting note: After going through some articles and answers posted on SO related to storing secured passwords I'm still not sure whether my way of thinking is applicable to todays reality. I'm ...
1
vote
2answers
70 views

Salt addition in hashing? [duplicate]

I may be wrong here but reading about salt I was wondering whether if we use the same salt for every password saved in our database won't users having same password would lead to same hash even after ...
0
votes
0answers
10 views

Does a static salt in addition to a random one add any security? [duplicate]

I'm looking through some old hashing code and found something that made me raise an eyebrow. In order to store passwords, it uses BCrypt to generate a random salt and hash the password. Before that, ...
0
votes
2answers
174 views

Is my hashing function good enough

Is there an obvious flaw with this hashing function (written in PHP)? function hash($password) { sleep(1); // Make hashing slow $hash = ""; $iterations = strlen($password); for ( $i = 0; $i ...