Tagged Questions

2
votes
0answers
53 views

Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash? [migrated]

H(s,r)=d is a function that hashes the string s with a salt r, giving the result d. Hashing functions are not injective, so there isn't a reverse function H'(d,r)=s. Therefore to prove that d is a ...
2
votes
1answer
170 views

Is there a better way to take advantage of current 'approved', 'proven', and memory/cpu-expensive algorithms while using salts and peppers?

I've read about the concepts presented in these two questions: Pre-hash password before applying bcrypt to avoid restricting password length Would it make sense to use Bcrypt and PBKDF2 together? I ...
6
votes
3answers
251 views

Is it secure to use bcrypt-generated salt in cookie to serve as token in place of a password?

I have a (hobby) web site that runs only on SSL. The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to secure it as much as ...
5
votes
3answers
338 views

bcrypt: random salt vs computed salt

I'm pretty new to the whole password hashing business, so I might be missing something obvious. I was looking at the bcrypt algorithm, in particular BCrypt.Net, and I was wondering if it wouldn't be ...
2
votes
1answer
180 views

PCI-DSS and salt storage

PCI-DSS states the following: 3.5 Protect any keys used to secure cardholder data against disclosure and misuse I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...