Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
1answer
50 views

How to identify the right hash from a list of salts and pre-given password during authentication?

I apologize for being naive, but I only recently started learning about cryptography and how to go about the security online. From what I've gathered, the safest-without-sacrificing-efficiency way ...
4
votes
3answers
4k views

Is it a good idea to use the user's username as a salt when hashing a password like hash(username_str + password_str)?

I'm helping my friend with hashing his passwords, and I've a question - Should he use one secret string as salt for hashing or is it better to have each user its own salt for hashing? Consider these ...
40
votes
0answers
10k views

For a hashing function like MD5, how similar can two plaintext strings be and still generate the same hash? [migrated]

When I say similar, I'm referring to the Hamming distance, the Levenshtein distance, or a similar string distance metric that measures how similar or dissimilar two strings are. For instance, are ...
7
votes
3answers
1k views

Is it a good idea to have a “master” password?

Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
1
vote
2answers
416 views

Is it known to what message size are standard hash functions injective?

This simple Python script verifies that all messages of length 1 have different SHA-1 hashes: import hashlib s = set() for i in range(256): s.add(hashlib.sha1(chr(i)).hexdigest()) print len(s) ...
818
votes
12answers
228k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
0
votes
1answer
62 views

Does it increase security to hash a SHA1 hash with a common salt with SHA256 with individual salt [duplicate]

I tried to find a similar question but I did not find a question describing my exact scenario and I am still puzzled if the following actually makes an application more secure. I have legacy ...
3
votes
3answers
231 views

Password hashing algorithms suitable for IoT devices?

What password hashing algorithms and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home ...
0
votes
1answer
36 views

Generate DEK from password using hashing on client-side

Important to know Will not be passing the DEK from client to the server The DEK will be used to encrypt all the data being placed within a github repository, it is possible that cipher-text will be ...
2
votes
0answers
60 views

Add additional rounds on existing SHA-512 salted hashes without knowing clear text password?

Assuming you have a salted SHA-512 password hash with 5000 rounds. For example: {CRYPT}$6$rounds=5000$6835c5dcf0bb7310$hVod/jy7uONMSa.FVpLHb/2OrWpAj3lB/....
36
votes
8answers
15k views

Isn't “Dave's protocol” good if only the database, and not the code, is leaked?

I've read "Is my developer's home-brew password security right or wrong, and why?", but still there's a question wandering in my mind: Even if someone uses a bad, home-brewed security algorithm just ...
0
votes
3answers
85 views

Is it possible to build a partial search mechanism on hashed values? [closed]

I am hashing some sensitive values to support search mechanism as decrypting the values at run-time would be time consuming. I'm using SHA-512 with salt. For now, things look good. I have the hashes ...
2
votes
2answers
112 views

Private contact discovery - calculating probability of false positive [closed]

I'm working on contact discovery for a service and want to do it in a way that maintains privacy as much as possible, without using Signal's Private Contact Discovery Service (https://signal.org/blog/...
0
votes
3answers
64 views

How to make the first request which used to create account safe? [duplicate]

To authorize user, our application defined below steps: Send user email and password (plain text) through HTTPS. When server received it, generate a salt to hash password and store it. When user ...
2
votes
4answers
419 views

Can a 32-bit hash be made into a 64-bit hash by calling it twice with different seed?

If I have a hash function that generates a 32 bit result with a good distribution (say murmur3): var h32 = hash32(str, seed); // returns a 32bit hex string (8 chars): '0123abcd' it will still ...
-2
votes
1answer
107 views

Which is the weakest hashing algorithm? [closed]

After studying about hashing algorithms and encryption formulas, I was interested to find which hashing algorithm was the weakest of all. I'm sure it is some weak and old algorithm, but it would be ...
19
votes
6answers
16k views

Can a neural network crack hashing algorithms?

I've been reading a bit about neural networks, and their ability to approximate many complex functions. Wouldn't a neural network be capable of cracking a hashing algorithm like SHA256? For example, ...
0
votes
3answers
161 views

Can a hashing function be implemented insecurely?

After working on a an imaginary security related project, it was decided that the project is going to use the imaginary hashing function X. There are various implementations of the hashing function ...
0
votes
1answer
82 views

Can we implement custom algorithms to encode and decode wifi password hashes between Windows 10 and our Router?

Windows 10 has its own way of encrypting hashes, but these can be brute-forced by hashcat. One of our students created 2 of his own password encryption algorithms in python (One for encode, one for ...
0
votes
1answer
56 views

What does a hash output (a fingerprint) can be truncated mean?

From Public key fingerprint (Wikipedia) : Creating public key fingerprints ... 3. If desired, the hash function output can be truncated to provide a shorter, more convenient fingerprint. ...
1
vote
2answers
371 views

Why doesn't form based authentication use digest instead of plain text

In form based authentication the credentials are sent as such within the message, whereas in digest based authentication a digest of credentials, domain name and a random challenge is sent instead. ...
3
votes
2answers
945 views

How is an SSH public key fingerprint calculated?

I have a public key as the following 64 bytes encoded string AAAAB3NzaC1yc2EAAAADAQABAAABAQDapfZSmaVBZimVC7YAsISc+fKzuhbVmmbJNYELWov4ZVbdbFxf790xC0sKQTmbe1iDt25DdsandggApKZh6yvWD0Li5RV+...
2
votes
1answer
78 views

Is there any benefit to using a salt when the cleartext is random data?

I understand that using a salt makes it harder to find cleartext using rainbow tables - but in that scenario the clear text is structured / low entropy. If my clear text is generated randomly, then is ...
2
votes
2answers
106 views

Hash value changes after first opening a file

Is it possible or normal that the hash value of a file changes just after the first opening/execution of it? I used sha256sum function within Ubuntu terminal to check the hash values before and after ...
2
votes
1answer
134 views

Cryptographic requirements for GDPR

I'm looking into how to store emails and data regarding GDPR. The reasoning is that it would be beneficial to store users emails linked to certain data (shop data about purchases and questionnaires). ...
1
vote
0answers
57 views

When knowing an individual's plaintext password history, how much information is expected to be gained with a new password? Do we know this?

The premise: Knowing a persons password history should provide information to help when guessing a new password of theirs. At an extreme end, with a password history of wildcats, wildcats1, then ...
0
votes
7answers
2k views

Using passwords made of words

People say don't use passwords in the dictionary but if you use two words isn't it alright? Dictionaries have at least 10,000 entries so just two words will be 100,000,000 possibilities (and that's ...
12
votes
3answers
11k views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
62
votes
1answer
13k views

I found a password with hashcat, but it doesn't work

My assignment required me to find the password for a PowerPoint file (97 - 2003, v. 8.0 - v. 11.0). I used office2john.py to retrieve the hash, and I removed the file name. The hash is: $...
0
votes
1answer
126 views

Estimating Password Cracking Speed Based on GPU?

I was wondering if there was a calculator or formula I could use to find a rough estimation of the time it takes to crack hashes based on GPU. I am trying to assess how much performance I would lose/...
77
votes
11answers
47k views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms. But I can think of quite a few ...
1
vote
2answers
83 views

Should Google User ID's be hashed when stored in the database

I'm currently developing an auth backend that allows for both Google and Email/Password as authentication methods. I'm basically treating the Google ID and Password as credentials here. I'm already ...
26
votes
4answers
6k views

Does putting salt first make it easier for attacker to bruteforce the hash?

Many recommendations for storing passwords recommend hash(salt + password) rather than hash(password + salt). Doesn't putting the salt first make it much faster for the attacker to bruteforce the ...
0
votes
1answer
53 views

How are these transaction fingerprints colored?

For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
499
votes
6answers
141k views

How to store salt?

If you expect to store user password securely, you need to do at least the following: $pwd=hash(hash($password) + salt) Then, you store $pwd in your system instead of the real password. I have seen ...
18
votes
2answers
24k views

How are Windows 10 hashes stored if the account is setup using a Microsoft account?

I was testing the integrity of my passwords and noticed that after I dumped the hashes, there was only one account where the NTLM hash was not a "default hash." I also know that that account happens ...
0
votes
0answers
66 views

Where are NTLM and LM hashes stored in a password protected microsoft presentation file

I have a password protected presentation file (MS office 2003). My assignment required me to either remove the password or find it. In my research i found out that presentation use ntlm and/or nt ...
1
vote
1answer
88 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
2
votes
2answers
60 views

Token-based group invitation link

I've searched this site and the web for an answer to this question, but haven't found what I'm looking for, so here goes. Pointers to existing relevant answers are much welcome as well. I'm building ...
1
vote
2answers
110 views

Can a document be digitally signed multiple times, successively by different users?

The question is, if a document that is collaboratively edited, one user per time, could be digitally signed by every editor before it is passed to the next editor. And if yes, could the final receiver ...
0
votes
2answers
521 views

Generating salt for hash that occurs on server and client

Let's say I have an API call which is supposed to check if email address exists in the DB, without transmitting the actual email address. For that purpose, I've decided to store SHA256 hash of the ...
1
vote
1answer
141 views

Breaking it gently

Let's say I've found a fundamental error with mathematics of a security package. For example, let's say I've found something similar to the Pollard’s \rho-1 algorithm that renders some of the RSA keys ...
0
votes
0answers
87 views

Custom password security algorithm? [duplicate]

How secure would it be if you applied custom algorithms (that you obviously wouldn't reveal to the public) to a hashed password? Like splitting up a hashed string, shuffling it around, possibly even ...
26
votes
3answers
6k views

How bad would a partial hash leak be, realistically?

Even though the current recommendation for storing passwords is the usage of a slow key derivation function such as Argon2, scrypt, PBKDF2 or bcrypt1, many websites still use the traditional hash(...
0
votes
1answer
81 views

What kind of hash does the VeraCrypt tool use?

Whirlpool? SHA-512? Or something completely different?
1
vote
2answers
335 views

Is my hashing function good enough

Is there an obvious flaw with this hashing function (written in PHP)? function hash($password) { sleep(1); // Make hashing slow $hash = ""; $iterations = strlen($password); for ( $i = 0; $i &...
179
votes
5answers
60k views

Recommended # of iterations when using PKBDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
2
votes
1answer
137 views

What are the minimum parameters for Argon2?

Argon2 is the winner of the Password Hashing competition, and currently recommended by OWASP for secure storage of passwords. One crucial step of Argon2 is determining the parameters used by the ...
18
votes
4answers
4k views

At what point does adding more iterations to PBKDF2 provide no extra security?

If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an ...
13
votes
3answers
3k views

Why is hashing a password with multiple hash functions useless?

I read online that it's useless and basically impractical to hash a password with multiple hashing algorithms (and not just one) before storing them in a database. I don't really understand why that ...