I know that hashes are used to bring the plaintext password in the right length for the encryption algorithm key. But is the password hash stores outside the encrypted container to validate the password? If so isn´t this a security vulnerability? Instead of attacking the encryption the attacker could just crack the hash. Is that how tools like rar2john or zip2john work?

If not how do they work, and why is the hash stored on the outside of the encrypted container?

1 Answer 1


The hash is a part of a container with encrypted data because of the two main purposes:

  • integrity check - rather hashing the encryption key then encrypted container is hashed to receive a digest. Then other side of a communication channel would hash received encrypted data and verify whether hashes match. If they do match - data is untampered during the transmission and decryption process starts.

  • authentity check - what if the container was intercepted during the transmission and both encrypted data and hash was substituted? To make sure this never happens some kind of key-derived hashing like hmac is used. Then without knowing the key attacker has no way to tamper data so the other party would not detect it. The hmac key is obviously should be shared between parties separately prior the actual transmission of an encrypted data.

As of the encryption key - in AES scenario the key should be already known to both parties prior the transmission of an encrypted data. Usually it's shared using some assymetric cryptography like RSA.

Google SSL or TLS to read more about how both symmetric and assymetric crypto play their role in such a way of communication.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .