774 reputation
1020
bio website
location
age
visits member for 2 years, 6 months
seen Sep 14 at 5:40

Aug
12
accepted Can /etc/passwd file be accessed on a cpanel shared hosting account?
Aug
12
accepted What was done to gain a list of home directory accounts?
Aug
12
accepted Is it okay to wrap a cryptographic hash with MD5 for storage?
Aug
12
asked Signed request vs HTTP digest auth for API authentication?
Aug
11
comment Does truncating the cryptographic hash make it impossible to crack?
Well it's not exactly "once" since in the first time you see the hash you can't tell at once if it was truncated and how many was truncated. If you are implying you have to make your software guess many times at "once" then yes I agree.
Aug
9
comment Does truncating the cryptographic hash make it impossible to crack?
Well that's the goal, to make the software/human assume and do more "thinking" therefore making it extra harder to crack.
Aug
9
comment Does truncating the cryptographic hash make it impossible to crack?
The assumption is the cracking software don't know it's truncated. Or if it knew, it doesn't know what was truncated.
Aug
9
comment Does truncating the cryptographic hash make it impossible to crack?
@B-Con By this time I now understand truncating too many is not a good idea since it's likely to cause collision. So my question now is, since truncation has it's (arguable) benefits (since Google does it according to Rook's answer below), how many truncation is the maximum we can do so that it won't be prone to collision.
Aug
9
comment Does truncating the cryptographic hash make it impossible to crack?
@B-Con Honestly I don't quite understand what the prefix and suffix of (n-m) means. I think it's better if the question was not "too" technical :-)
Aug
9
comment Does truncating the cryptographic hash make it impossible to crack?
Proper salts meaning unique per user, random, at least 20 characters right?
Aug
9
comment Does truncating the cryptographic hash make it impossible to crack?
I do agree that truncating "too many" characters makes you vulnerable to other passwords but given you have unique salt and iterations do you still not recommend truncating? Wouldn't truncating 2 or 3 characters protect you from dictionary/rainbow attacks since if the hash ever matches something the original value will never be known?
Aug
9
comment Does truncating the cryptographic hash make it impossible to crack?
Regarding caution, as stated in the question "along with salts, iterations, etc." :-)
Aug
9
comment Does truncating the cryptographic hash make it impossible to crack?
Agree, I guess it depends on how many characters I truncate? The chance of collision with a different password is probably very tiny if I just truncate say 2 or 3 characters right?
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
Agree, the only reason I chose md5 is it returns 32 bytes vs sha1 which is 40 or sha256 which is 64. But I think I will use sha256 instead then truncate.
Aug
9
asked Does truncating the cryptographic hash make it impossible to crack?
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
Yes all input will have to go through hash() first before md5(). On another note, I guess it goes without saying that in case the attacker obtained the database of hashes, the md5() wrapping actually makes his job one step harder right vs just hash() alone ?
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
Thank you for the thorough explanation. Just to confirm in layman's term, do you agree that there is no problem in $hash = md5(hash($password,$salt,$rounds)); for as long as hash() internally uses a strong algo like bcrypt ?
Aug
9
revised Is it okay to wrap a cryptographic hash with MD5 for storage?
added 382 characters in body
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
@Piskvor I already told you that.
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
@Piskvor It's not really about shortage of space, it's just that if it actually helps or doesn't affect security then why not, besides, they look clean in short hashed form.