Linked Questions

6
votes
3answers
21k views

How hard would it be to crack bcrypt hashes if the salt is unknown? [duplicate]

(This is not a duplicated of the linked question IMHO as this is more about the differences between a salt and password: both variables used to generate a hash) Let's say an attacker has offline ...
12
votes
3answers
2k views

Cryptographic Security of Dynamically Generated, Non-Random Salts

So when it comes to security, when I have an idea that seems good, but no one else seems to be doing, I try to assume that I'm overlooking something obvious or otherwise significant. This is one such ...
7
votes
3answers
7k views

How to login and encrypt data with the same password/key

I've made a "vault" web app in PHP for storing passwords, credit card numbers, etc. It's mostly just for myself, but I'm practicing building it with multiple users in mind. I use two way encryption to ...
2
votes
3answers
2k views

Key stretching a hash

If I implement a function which hashes the first half of my password with MD5 and the second half with SHA-2 and MD5, is there a security issue when I put these two hashes together to create a 64 ...
4
votes
3answers
1k views

Password security with short passwords

I know that a long password is a good password. However, some sites require short passwords e.g. exactly 8 characters long. Under those limitations, what is a good method of creating and memorizing a ...
5
votes
3answers
2k views

Are there any disadvantages to encrypting the password hash?

Is encrypting the password hash in database more secure than storing only the hash? Suppose we store encrypted SHA-256 result with AES instead of hash directly. Is this a good protection from a ...
6
votes
1answer
858 views

Would appending junk data to user passwords before hashing affect security?

I've seen similar questions on the site but not this exact one. The closest one was Altering passwords before storing where the accepted answer sums up by stating that transforming the password is ...
5
votes
2answers
2k views

Can a HSM be used to make password hashing stronger?

Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
6
votes
1answer
994 views

Should password hashes be encrypted or HMACed?

Assume I am hashing user passwords with PBKDF2, bcrypt, scrypt, or some other secure key derivation function. Are there: tangible security benefits, precedents, and respected research for ...
0
votes
5answers
2k views

Why can salts be public? [duplicate]

From what I understand, salts are called "salts" rather than "keys" because they are allowed to be public. I understand that applying a random salt makes it difficult for rainbow table attacks because ...
4
votes
3answers
1k views

Is it worth padding passwords?

I'm using phpass (bcrypt) to hash the password and SSL when it's transmitted, and using PDO (with PHP) to stop injections, is it worth padding the password, so that if the user enters "123456" as the ...
-2
votes
2answers
1k views

Password hashing and blowfish [duplicate]

What I'm about to say is probably going to make me look like an idiot but it's better to be wrong and learn than have unanswered questions. Ever since I started dealing with passwords I wondered what ...
3
votes
1answer
748 views

Is there a better way to take advantage of current 'approved', 'proven', and memory/cpu-expensive algorithms while using salts and peppers?

I've read about the concepts presented in these two questions: Pre-hash password before applying bcrypt to avoid restricting password length Would it make sense to use Bcrypt and PBKDF2 together? I ...
-1
votes
1answer
748 views

What encryption hash function I should use for password securing? [duplicate]

Possible Duplicate: How to securely hash passwords? What is the best encryption algorithm? MD5, SHA1, SHA2 or maybe something else? Can you explain me why?
1
vote
1answer
1k views

What is the right way to implement Keyed Password Hashing?

As mentioned in this wonderful link, the way to get a PBKDF2 Hash of a user given password given a password (of course), a salt (generated Cryptographically Secure Random Number Generator. iteration ...

15 30 50 per page