Tagged Questions

A salt is a random addition to a password to make the hashed password less susceptible to a lookup table attack

learn more… | top users | synonyms

3
votes
1answer
238 views

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

This is going to get long, so prepare. Basis of the question is, Do all these steps improve security, or am I completely overthinking the problem? Are my assumptions/thought process valid? We all ...
5
votes
2answers
680 views

Can the IV + Salt be the same?

During my encryption app i've got the password creation bit: PBEKeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 10000, keyLength); and later on the actual encryption part: ...
8
votes
5answers
1k views

Should I remotely store my salt? [duplicate]

When users register on my site, I want to store their username and hashed password in my database. When I hash that password, I'm going to salt it using PHP. The issue is, I don't want to store the ...
5
votes
2answers
614 views

Authentication: Username (email) and password hashed together in one database field

I am currently developping a platform with a PHP framework for our client. The head of the client's IT department wants us to handle authentication with one database field containing ...
1
vote
2answers
117 views

Is it a good idea to use the user's username as a salt when hashing a password like hash(username_str + password_str)?

I'm helping my friend with hashing his passwords, and I've a question - Should he use one secret string as salt for hashing or is it better to have each user its own salt for hashing? Consider these ...
-2
votes
3answers
120 views

My friend hashes passwords with SHA512 algorithm without salt. How do I convince him that he needs to add salt?

Today I discovered something incredibly stupid - my friend hashes user passwords with sha512 algorithm without a salt. I immediately raised this issue to him but he said he wants to see anyone crack a ...
3
votes
3answers
481 views

Accepting other similar passwords when storing a salted, hashed password

If a website stores passwords as a salted hash, is it reasonable to accept similar passwords as correct? For example, given the password stackexchange, does it dramatically decrease security if the ...
1
vote
2answers
123 views

Search on hashed data

We have a request to encrypt customer personal data (e-mail, address etc.) We use MySQL which does not have any TDE like MS SQL or Oracle. So along with encrypting data we need to preserve ...
3
votes
2answers
172 views

Is there a strong reason to salt and hash passwords when password reuse is not an issue?

I am dealing with a system (in development) that uses randomly generated (not user provided), unique, strings to authenticate services that will consuming an API. Right now, these strings are stored ...
4
votes
1answer
121 views

Using random number to salt passwords

in a project I have, I'm salting passwords with 3 salts at the moment... Static salt - hard-coded into the source-code. Randomly generated salt (using a function designed for generating password ...
12
votes
2answers
584 views

How Does A Random Salt Work? [duplicate]

I don't understand how using a random salt for hashing passwords can work. Perhaps random salt refers to something other than hashing passwords? Here is my thought process: The salt is used to add ...
-2
votes
1answer
70 views

Salt and password [closed]

Reading the doc for setting the password, the command is : python -c "import crypt; print crypt.crypt('password', '\$6\$SALTsalt')" SALTsalt is the 8-character crpytographic salt. Valid characters in ...
2
votes
1answer
111 views

How to autenticate properly in Java

I have to write some login module for Java EE application. Previously i was using JBoss security - provided login and password, called HttpServletRequest with login method and JBoss security did the ...
0
votes
1answer
66 views

Good way to make a secure token for logged out users

I work for a firm that has a marketplace on the web. We want to make a link with a token that stops an ad on the marketplace without the user being logged in. Someone suggested that we make a token ...
2
votes
4answers
708 views

Using last characters of hash as salt [duplicate]

In a recent discussion somebody mentioned the following hashing scheme: passHash = sha256(password) saltedHash = sha256(passHash+passHash.substr(-10) finalHash = sha256(secret+saltedHash) The ...
0
votes
1answer
117 views

Save password on user-side for autologin

If a user wants to login to a system/server, it's recommended to have the hashed&salted password saved in a database, along with its salt. So the user wants to login, types in the password, ...
0
votes
1answer
77 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
1
vote
2answers
98 views

Is it unsafe to hash one password with more than one salt?

I'm asking my question here since I was not able to find an answer anywhere. I have written a piece of software which stores pretty delicate passwords. I have used BCrypt as hashing algorithm with an ...
2
votes
1answer
202 views

MySQL Authentication Hash Cracking

I'm currently conducting research regarding MySQL server remote authentication. I've captured unencrypted, uncompressed authentication packets between the client and the server where the username is ...
-1
votes
2answers
89 views

How does salting increase security? [duplicate]

I'm currently going through a course on software security. I've recently been introduced to the idea of password salting, where a random value is concatenated to a password prior to being hashed and ...
0
votes
3answers
61 views

How to secure Password and Salt on a deployed application

I have a question regarding one step of protection more than salt/hash. I work on an application that is distributed to many clients and then deployed on their networks. If I set a password on one ...
2
votes
2answers
110 views

Breach informing

I am a staff member of a large fanfic site, but not the head administrator with control over the site itself. Recently, we had a security breach and the databases were copied, which included the ...
8
votes
3answers
4k views

How often do two users use the same password

If no two users use the same password, then in theory salting the password hash is not needed. How often, in practice, do two users have the same password?
70
votes
8answers
9k views

Convincing my manager to use salts

My manager says we don't need to salt our passwords because people are not likely to use the same password because they all have different native languages, in addition to the websites they are active ...
0
votes
2answers
166 views

When I reset my password for my Microsoft account, how do they know what password I've used before?

Assumption used: all password that I've used have been salted with some random elements before hashed and stored somewhere in their database. If my previous password exists only as salted-hashes in ...
2
votes
1answer
190 views

Any reason I shouldn't be salting and hashing before putting through bCrypt?

I've been reading up on password storage and such, and have come to the conclusion that I need to be using bCrypt. I've got an implementation working correctly, but I'm wondering the best way to move ...
3
votes
2answers
183 views

MySQL ENCRYPT salt is not random?

I know there's little reason to still use ENCRYPT() nowadays, what with bcrypt being almost ubiquitous and MySQL providing better hashes such as SHA1. But while dabbling with ENCRYPT() on MySQL ...
3
votes
2answers
152 views

Search on encrypted data of multiple users

I want to implement a search over encrypted data. I found a blogpost, which explains 3 methods. One method is to use deterministic encryption, which I'm trying to implement. But my use case is a ...
55
votes
3answers
18k views

How can I create a password that says “SALT ME!” when hashed?

How can I create a password, which when directly hashed (without any salt) with md5 will return a string containing the 8 characters "SALT ME!". The hope is that a naive developer browsing through his ...
2
votes
1answer
123 views

How difficult it is to solve a salt if knowing the original data and the hash output that uses the SHA-2 algorithm

I am reading the documentation for Kentico where it describes using hashes to validate query strings ...
2
votes
4answers
389 views

How does a system authenticate a user using a hash function, after it has been salted?

I don't really understand how salting works. I read the Wikipedia article, but I still don't understand how can a system authenticate a salted hash? Let's say a user chooses a password. It's randomly ...
2
votes
4answers
107 views

Random salt - necessary for a single user?

Based on: http://security.stackexchange.com/a/33520/42220 and http://security.stackexchange.com/a/41630/42220 I can see the benefits of a completely random salt per user. If I am implementing an ...
2
votes
1answer
230 views

php crypt - trailing dollar sign - extract only the salt part from hash - padding the salt

I am reading up on PHP's crypt() function. I have a few questions on it - What is the significance of the trailing '$' sign at the end of the salt string that I see in most examples. The manual ...
1
vote
1answer
232 views

Hash Security of Windows 7 Password

I need to find some materials about how Security Accounts Manager(SAM) works in windows 7+. I am confused with the storage format of hashed value. Many materials (such as, 1) tells me that it uses ...
1
vote
3answers
1k views

Is Salt, IV and Key necessary when encrypting password in a database using AES? If so, how should they be used?

Imagine I have a website with user accounts. I want to authenticate users, so I need to know if the password they provide matches the one stored in my database. To protect the passwords from prying ...
3
votes
2answers
1k views

How weak is MD5 as a password hashing function ?

A professor told us today, that MD5 is weak. I understand his chain of thought but pointed out, that IMHO MD5 is a good way to go if you would use a long (even really long) dynamic salts and static ...
0
votes
2answers
93 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
0
votes
3answers
117 views

Using a Hash as a Salt? [duplicate]

Ive done a bit of reading on the subject of Hashes and Salts and I came up with an idea for a salting scheme but I wanted to check it with some people more learned than myself. My basic idea is to ...
1
vote
3answers
599 views

What is the correct way to make a password salt?

I've made the below function to make a completely random 64 character long hash function password_salt($password){ $salt = hash("sha512", mt_rand(1,100000) . strtotime("now") . $password . ...
1
vote
2answers
127 views

How to use ESSIV to avoid seeing repeated patterns?

I'm trying to implement an encrypted file-system. The file-system consists of 512-byte sectors. I encrypt/decrypt the contents of a sector as follows: Compute the SHA256 sum of the user password. ...
126
votes
8answers
12k views

Why are salted hashes more secure?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...
1
vote
0answers
59 views

How do I determine whether a Linux-based router still has the default password? [duplicate]

My goal is to check if the password used by admin is the default password. I work on a Linux-based router. I know the password is stored as a hashed value in /etc/passwd. In generic Linux machines, ...
1
vote
1answer
258 views

Hashing Passphrase in Client-Side JavaScript Rather than Server-Side — Is it Viable?

Yet another salting-and-hashing-for-web-sites question has been left on the doormat of Information Security's StackExchange. The oft-mentioned approach for website password-handling is to use a ...
16
votes
3answers
2k views

Is it safe to write the salt AND/OR the IV at the beggining of an encrypted file?

I want to encrypt a file with AES in CBC mode (maybe another mode is better for file encryption...I don't know, but suggestions are welcome!). What I usually do is that I first write a few random ...
1
vote
1answer
113 views

Sending Salts For Key Generation

I am working on a project that uses a combination of a web based framework (Django) and an installed app (Python) for the purpose of data entry/upload. I will have to send medical records over the web ...
3
votes
2answers
1k views

Why would you need a salt for AES-CBS when IV is already randomly generated and stored with the encrypted data?

I was looking at this code and came across these comments which says encrypting without a salt is insecure. Why would it be insecure when you are already using a random IV for each value? I think the ...
4
votes
3answers
547 views

Why not hashing and salting passwords?

When I was implementing my webapp, I decided to hash and salt users' passwords in order to protect them, even though I knew that there will never be a lot of them ... if any. Of course, I'm not saying ...
3
votes
1answer
159 views

using counter instead of salt for hashing

I'm developing own protocol for secure message exchanging. Each message contains the following fields: HMAC, time, salt, and message itself. HMAC is computed over all other fields using known secret ...
1
vote
2answers
241 views

Do I need to salt PBKDF2 when it's used for AES encryption

If I'm using PBKDF2 to stretch a password into a suitable key for use in encryption with AES, should I be using a random salt (for PBKDF2, not the AES IV)?
0
votes
1answer
91 views

Transmission of messages

I am currently developing a game which will be run in a client, they will sign up for this game online and create their account there, their information will be stored into a MySQL database. I am ...