Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash? [migrated]
H(s,r)=d is a function that hashes the string s with a salt r, giving the result d. Hashing functions are not injective, so there isn't a reverse function H'(d,r)=s. Therefore to prove that d is a ...
Is there a better way to take advantage of current 'approved', 'proven', and memory/cpu-expensive algorithms while using salts and peppers?
I've read about the concepts presented in these two questions: Pre-hash password before applying bcrypt to avoid restricting password length Would it make sense to use Bcrypt and PBKDF2 together? I ...
I have a (hobby) web site that runs only on SSL. The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to secure it as much as ...
I'm pretty new to the whole password hashing business, so I might be missing something obvious. I was looking at the bcrypt algorithm, in particular BCrypt.Net, and I was wondering if it wouldn't be ...
PCI-DSS states the following: 3.5 Protect any keys used to secure cardholder data against disclosure and misuse I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...