Tag Info

Hot answers tagged

39

As Mike and Gumbo have mentioned in comments, a salt isn't intended to add protection to bad passwords. It's meant to keep the attackers from breaking the whole database at once. The length of the salt isn't meant to add difficulty to breaking the stored passwords. It's meant to ensure that your salt is reasonably unique compared to others on the Internet, ...


37

It is fundamentally impossible to validate a client on a system you don't control. That doesn't mean it can't be done to a sufficient degree. eBook readers, for example, generally try to ensure the client is authentic. They (seem to) do so in a manner that is secure enough to defend against their threat. Good enough to protect nuclear secrets? No. But ...


36

There is no absolute answer, because it depends on the attack model. By truncating the hash, you make some operations easier; this is bad if the attacker wants to perform these operations, and making them easier actually makes them feasible. There are three main characteristics that cryptographic hash functions try to fulfil: Resistance to preimages: ...


34

You have to consider two attack vectors: Online attack Offline attack Limiting login guessing helps against Online attacks. Let's say it's three times, this means that an attacker can test ALL accounts for the three most common passwords that fit your password policy (how about "password", "12345678" and "12345"?). Salting helps against Offline attacks ...


19

It is fundamentally impossible to validate that an unmodified version of your client connects to your server. ... unless you do what is necessary to ensure it. This means client-side tamper-resistant hardware. When your code runs on the client's computer, the computer owner can run a debugger and modify the client code at any point with arbitrary values. ...


14

Regarding truncation in general, it's not necessarily bad at all. In fact, the SHA‑384 algorithm is defined as doing a (slightly modified) SHA‑512 and then truncating the result to 384 bits. I'd like to add to the existing answers by providing the relevant material regarding truncation from the SHA standard. FIPS 180‑4, the SHA standard, ...


14

This basically looks like something along the lines of PBKDF2 or sha512crypt, only with a bunch of "cryptographic voodoo" applied. Salts have a very specific cryptographic purpose: to tie an password-guessing attempt to a single password instance. Having company-specific salts, user-specific salts, per-iteration salts, and (to steal a snark) hand-harvested, ...


14

A too long salt will not reduce security. A too short salt will reduce security. As the salt gets longer security will improve. At some point you will cross a boundary, where you start getting diminishing returns on increasing salt length. And eventually you will cross another boundary, where a longer salt does not add any security whatsoever. However ...


10

You could try Cryptographic Obfuscation when it exists Cryptographic Obfuscation is were, in certain senses, you make a programs source code unreadable. What you can then do is hardcode a cyrptographic key into the program. You would also want the server to supply a random seed to your program since the computer could not be trusted. The only problem with ...


5

"MD5(SHA-1(password))" is more secure than "MD5(password)" in the following sense: computing SHA-1 then MD5 on a candidate password takes about 2.5x the time it takes to compute only MD5 on the same password. Thus, it makes naive dictionary attacks 2.5x slower. It still is pathetically weak, for two reasons: 2.5x slower than a single MD5 is still awfully ...


5

I too have approached an issue such as this with the company I work for. after weeks of working it out, the answer is its not really possible. And here is why: You're basically encountering a "Trusted Client" problem. The client code runs on the user's PC, and the user has full control over the PC its originating from. The user can change the bytes of the ...


5

According to the length of the text it could be one of the following hash formats: DomainCachedCredentials Haval128 MD2 MD4 MD5 NTLM But (because it is a hash, a one way function) you can't decrypt it. You can try to brute force it, but this will possibly take a very long time. All the rainbow tables I know were unable to identify the original ...


5

The only property of a salt that is important from a security perspective is that it is globally unique. The length may impact how unique the salt can be, but is irrelevant from any other perspective. Assuming that it has a positive or negative effect on anything is to ask the salt to perform a function that it was never intended to serve. So, a salt should ...


4

Why it does not guarantee integrity is easier to see in the case of a stream cipher like RC4, where the encryption is a bit-by-bit XOR of the data with a key-dependent stream. Basically, the encryption of message m is: e = m XOR sk, where sk is the RC4 output (a long stream of pseudorandom bits produced from the key k). Suppose that you ...


4

No, it does not mean they are storing the passwords in plain text. The question doesn't completely describe the behavior. Are they matching patterns only from your current password, or patterns from all 8 of your previous passwords? If it's the first case, the answer is dead simple, and this is that they have the hashes from the 8 previous passwords ...


4

First of all, every stored password should be hashed with a different pseudo-random salt. Second, SHA-256 is not appropriate for storing passwords; instead, you want to use a key stretching algorithm, as has already been mentioned. There is a lot more detail at Crackstation. An encrypted hash is also called a keyed hash, and the key is sometimes called a ...


3

Making a hash function "iterative" already exists; it is called PBKDF2. Bcrypt is still preferable because PBKDF2 can be thoroughly optimized on GPU. Designing a good password hashing function is a difficult job; but yes, existing hash function are good building elements, so they are likely to be involved at some point. Indeed, look at scrypt: it starts and ...


3

The SAM database is stored as a file on the local hard disk drive, and it is the authoritative credential store for local accounts on each Windows computer. This database contains all the credentials that are local to that specific computer, including the built-in local Administrator account and any other local accounts for that computer. The SAM ...


3

password_verify() takes two arguments: a string of which you want to check if it's the correct password, and the value you calculated earlier with password_hash(), which you presumably stored somewhere in a database or so. A typical application could be: <?php $hash = password_hash('my-secret', PASSWORD_DEFAULT); // normally you would save the hash ...


3

From what I can tell from the comments, you want to use stronger and weaker passwords depending on the sensitivity of the file. For that, I suggest a different approach: Instead of having different passwords, require an extra password for the more sensitive documents. So all files are encrypted by default by the standard password, and the more sensitive ...


3

From Wikipedia: A 2013 attack by Xie Tao, Fanbao Liu, and Dengguo Feng breaks MD5 collision resistance in 2^18 time. This attack runs in less than a second on a regular computer.[2] This means that there's a weakness in MD5's ability to distinguish between different input data - that two arbitrary inputs may calculate the same hash. In April 2009, ...


3

Provided that you mean Hash first (BCrypt) and then encrypt the hash, security should not be weakened, yet you are not improving security either. Encryption is, by definition, a reversible scheme. Since there really is no use-case for which you would require the decryption in this case, encryption is the wrong tool for the job. If you are looking use a ...


2

Existence of a tool that can guarantee security of some encryption system would entail proving a number of hard scientific problems, up to and including the famous P vs NP. Right now, no cryptographer has succeeded in proving that secure encryption or hashing can actually exist, let alone designed a tool that could test a given system. All we have are ...


2

When a hash function has an output of size n bits, then: The generic algorithm for finding a preimage (or a second preimage) has average cost 2n evaluations of the hash function. The generic algorithm for finding a collision has average cost about 2n/2 evaluations of the hash function. By "generic" we mean "the algorithm that works against every hash ...


2

The problem is that hashing provides nothing in terms of integrity in your scenario. You are relying on the encryption alone to assert integrity. If I get a hold of the message and decrypt it, I could alter the message, recalculate the hash, encrypt it again and pass it on. If you trust encryption alone to provide integrity, then this process works, but ...


2

The Algorithms are broken : We can manually generate false certificates given only the md5 signature, for instance. Many weaknesses have been found is SHA-1 to this day, but as far as I know, you can't yet generate a false certificate matching a SHA-1 hash. However, it is being considered obsolete, security experts think this weakness may soon come, and are ...


2

The password in SRP is actually a shared secret of (possibly) low entropy. It can be the "password" as the human user understands it, or anything that is deterministically derived from the password. In your case, yes, using a password hashing function such as PBKDF2 is a valid approach. It has the following caveats: PBKDF2, like bcrypt and other good ...


1

No. A collision for H is a pair of inputs m and m' such that m ≠ m' but H(m) = H(m'). It follows that H(H(m)) = H(H(m')), and also H(H(m)) xor H(m) = H(H(m')) xor H(m') , and so on. Thus, any collision for H is also a collision for all your functions H2, H3, H4... These functions are thus in ...


1

Your understanding of the reasons why one should use scrypt and bcrypt is correct. Yes, you could, at least in theory, produce a new algorithm that requires time and memory, and it could incorporate an existing cryptographically secure hash function. You can increase time through iteration, and increase memory by requiring large numbers of prior values to ...


1

In order to support "partial passwords", the bank must necessarily store either the plaintext password, or at least some values that would allow fast reconstruction of the complete password. It is easily seen in the following way: when the bank asks for, say, the 3rd, 4th and 8th letters of the password, then there are less than one million possibilities ...



Only top voted, non community-wiki answers of a minimum length are eligible