New answers tagged

1

I'm not a security expert but my reasoning is the following: If you encrypt the information using shared key (known to you) then you can decrypt data on server and compare it. If you encrypt data on the clients using individual keys you can not decrypt the data but you cannot compare them. I see two solutions Simple - hash the data (using shared secret) - ...


5

I will assume that clients answer a series of n boolean questions. The server stores their answers in such a way that you that admin can not know their responses. Then the server identifies pairs of clients with identical responses. Then could not you the admin (or anyone really) create 2^n dummy accounts (all possible responses to the boolean questions). ...


0

Salt doesn't prevent dictionary attacks. Salt slows down dictionary attacks. Imagine that I have a database with a bunch of users and passwords: user1:2ac9cb7dc02b3c0083eb70898e549b63 user2:60bd8ed7a768e8bd6925beb0a691aadb user3:2ac9cb7dc02b3c0083eb70898e549b63 user4:8e601d1cd9d9ea079d8f15a0414e5d2b user5:306578f0e3e22fc26e9295069d9961b1 You don't know ...


0

How could using a salt in this case prevent any attack (e.g. dictionary attack)? The purpose of a salt is to increase the computational work the attacker must perform by ensuring the same password is hashed differently for different users. Let's say you have 1,000 users. And let's say the attacker uses a dictionary of 100,000 words to try as ...


0

Salting by itself does not prevent a dictionary attack against the password itself. But it makes rainbow-table or common password attacks against the hash much harder. If you use a PBKDF instead of a simple hash o HMac, a dictionary attack against the password may become infeasible, too. P.S.: The salt is nothing to be kept secret. Its only purpose is to ...


0

The only data we have to work with is: input data and length output data and length Conceptually the output data itself should provide no information since cryptographic hash algorithms are not meant to convey information in their output. The only bit of information that's useful here is the length of the output data which is 105 hex digits indicating ...



Top 50 recent answers are included