Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
2
votes
3answers
823 views

User specified iteration count

I'm working on a PHP authentication and registration system following the standard salt+password = 'auth hash' and using the plaintext/unencrypted username as the lookup field on the initial query. ...
5
votes
2answers
982 views

Why is 8ms a goal for hashing?

I'm currently developing a small project in PHP, and as it involves user authentication, I've been researching what options I've got regarding hashing. I've settled on PBKDF2 primarily due to it's ...
3
votes
0answers
286 views

Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]

In my school everyone must change their password every six months. The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...
0
votes
1answer
2k views

Why store the password salt instead of generating it? [duplicate]

So, reading through this article: http://crackstation.net/hashing-security.htm it says that storing the salt is fine in plain text because it renders the lookup/rainbow tables ineffective. I get that, ...
25
votes
8answers
9k views

Why should I hash passwords? [duplicate]

I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it? When a ...
-1
votes
1answer
1k views

Properties for cryptographic hash functions (preimage, second preimage and collision resistant)

While studying computer security at university I have been asked this question: There are three desirable properties for cryptographic hash functions: Preimage resistant, Second preimage resistant, ...
0
votes
0answers
43 views

How can I determine the encryption used by knowing input and result? [duplicate]

Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
-8
votes
2answers
957 views

the Informix password crack

I get some hash like: username sowainformix salt 7307821250330563328 hashed_password HaHvvzanjp_lPZgHLu0KHquN.Q4t98EF48csXk1QTJs hash_type SHA-256 updated flags ...
8
votes
2answers
4k views

Does the md5 (or any hash for that matter) of a string include the null terminator?

Does the md5 (or any hash for that matter) of a string include the null terminator in its calculations? That is does the hash of a string equal the hash of the sequence of bytes that represents the ...
11
votes
2answers
5k views

“Official statement” on php.net : CRYPT_BLOWFISH is strongest hash algorithm. Why?

First: I asked this question on stackoverflow and was kindly asked to post this here again. See the original question here. According to the [early] doc pages of the new PHP 5.5 password hashing/...
5
votes
2answers
3k views

Do SSD's offer significant performance boost for Scrypt?

Being a memory intensive hash, I was wondering if SSD's offer any appreciable performance boost for brute force attacks.
3
votes
2answers
775 views

Does glibc2 version of the crypt function still use DES for alternative hashing methods?

I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
2
votes
3answers
1k views

Salting in encryption (rather than hashing)

I am aware of the benefits of adding a salt to values that are hashed using a one-way function. Is adding a salt to a value that is being encrypted (using symmetric encryption) considered to be good ...
3
votes
4answers
723 views

When salting and hashing passwords, any advantage to including password length?

In this answer, Gilles says (emphasis mine): There's no need to hide the salt from the attacker: it needs to be unique (and not derived from the password) but it doesn't need to be more secret than ...
40
votes
8answers
17k views

Is salting a hash really as secure as common knowledge implies?

(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.) I'm implementing a salt function for user passwords ...
4
votes
1answer
8k views

What is the collision chance of a 128-bit hashing function if it is always fed with 256-bits of data?

I mean "normal" collisions not based on any attack. How do i calculate it?
5
votes
1answer
217 views

Could a password hash that's prone to more collisions provide better overall security?

Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
12
votes
4answers
14k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
6
votes
1answer
617 views

Is the execution time for bcrypt independent of the length of the input string?

Is the execution time for bcrypt independent of the length of the input string? i.e. Should the execution time of bcrypt.hashpw('input_string', bcrypt.gensalt(12)) and bcrypt.hashpw('...
1
vote
1answer
4k views

How secure is my private key in the Windows Digital Certificate store?

Many files we download don't have digital signatures. Files may get infected or someone may intentionally modify them on our hard disk. So I wrote a simple file hashing program in c# that creates a ...
1
vote
4answers
2k views

Why one time passwords using nested hash chain are not used?

I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
1
vote
2answers
174 views

Does hash solve passwords in parts?

From an answer this earlier question: Does adding dictionary words to passwords weaken them? "...you have no way to recognize it as a password before testing it (against a hash or an online ...
3
votes
1answer
621 views

Are there any uses of having a non-deterministic salt value for hashes?

So I've been toying with the idea of having non-deterministic salt values for hashes. Let me explain what I mean: Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
2
votes
1answer
911 views

Hash extension(padding) attack

I recently came across this website talking about sha1 padding attack. https://web.archive.org/web/20140729003849/http://www.vnsecurity.net/2010/03/codegate_challenge15_sha1_padding_attack/ After ...
3
votes
1answer
554 views

How to determine hashes/second in password cryptanalysis

I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt. I'd like to ...
23
votes
2answers
12k views

Truncating the output of SHA256 to 128 bits

Suppose we need/prefer 128 bit hash output, for example to generate a 128 bit encryption key or, in other applications (e.g. file integrity verification), to consume less storage space. I don't know ...
12
votes
1answer
785 views

“Please Enter Nth Character” without HSM

This question has been asked a few times, but always in the format "How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?" And the answer ...
0
votes
4answers
423 views

multiple hash values in a single malware file

Can a malware file have multiple "Hash values"?
8
votes
3answers
1k views

Is Using MD5 Sufficient Reason to Reject This Payment Processor?

I'm evaluating a credit card processor[1], and I noticed they are using MD5 as part of a salted hash algorithm to protect a secret key. Since I know MD5 is generally considered broken, this feels like ...
14
votes
3answers
14k views

With ASIC bitcoin miners, should SHA256 be considered insecure for password hashing?

I'm sure everyone here has seen the rise and further rise of bitcoin. The process used for mining bitcoin is basically "let's brute force an SHA256 hash that is less than this amount" That being ...
9
votes
3answers
8k views

What does GUID have, that a Whirlpool, MD5 or SHA-2 hash don't?

I'm trying to understand the use of GUID and what has always left me wondering is what's so special about them that I should consider using them instead of rolling my own type of unique ID. In other ...
2
votes
1answer
126 views

Securely store two values per user in SQL

I have come across the need in my web app to store two values for each user. These values would need to be retrievable from a value stored in a URL. I would prefer to store neither of the values in ...
79
votes
5answers
78k views

How does hashing work?

I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it ...
12
votes
4answers
4k views

Handling passwords in a web application

I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
7
votes
1answer
583 views

Encrypting short identifiers?

I am developing a webapp that does not reveal record count, because it hides the primary key. I am looking for a better way to do this. My favorite idea is to encrypt the ID itself with a block ...
4
votes
5answers
3k views

Expanding/Inverse Hash function

First off, before I ask my question, let me explain what I am NOT asking. I am NOT asking for a way/method to reverse a hash output; by definition, a hashing function is one-way. Is there such a ...
11
votes
2answers
1k views

PINsentry PRNG and Bank Cards

My bank provides me with a device similar to this: The device is essentially a PRNG, presumably based on the date/time of it's internal clock, synchronized with the bank servers. To generate a pin ...
2
votes
1answer
679 views

Use brute force to mitigate brute force

Just an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information. My idea is this... When storing a password in ...
81
votes
10answers
9k views

Why improvising your own Hash function out of existing hash functions is so bad

I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes. After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
23
votes
5answers
3k views

When hashing passwords, is it ok to use the hashed password as the salt?

I don't like this idea. But I can not come up with a technical argument against it. Can somebody explain it to me? The basic idea is: $passwd = 'foo'; $salt = hash($passwd); $finalHash = hash($passwd ...
8
votes
3answers
4k views

NTLMv2 resistance to bruteforcing

I have a question regarding NTLMv2 resistance to password bruteforcing. I know that some modern graphic processors (like Radeon 6990) are able to calculate billions hashes per second and crack NTLM ...
15
votes
4answers
4k views

Is there a length beyond which increasing password length provides no additional security?

Assuming that the password is stored hashed and salted, and that it is a string of random characters, is there a point where adding to password length doesn't add security? Since the hash will have a ...
1
vote
1answer
93 views

Parameters in output of password hashing function

A number of encryption functions include their tuning parameters in the output. For example, SCrypt, which I've been considering for an app I'm building, outputs in the following format: $<version&...
12
votes
4answers
14k views

What security purpose do hashes of files serve?

Many websites offering downloads also provide the MD5 or SHA1 hashes of the files which are available for download. An example- What is the security purpose behind providing such a facility to the ...
24
votes
6answers
11k views

Why does some popular software still use md5?

Nowadays no one dares to defend md5 for any use, and of course they should not! However, much popular software still uses md5 in applications such as password hashing (although it's not simple/plain ...
6
votes
1answer
2k views

Reducing password length with hash function

Suppose I would like to use a very long string as a password. As an example we can just say this string is 100 characters in length. However, suppose the application for which I would like to use ...
33
votes
2answers
38k views

Why are GPUs so good at cracking passwords?

What is it about GPUs that lets them crack passwords so quickly? It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
3
votes
2answers
3k views

Does it make any difference of the order Hashing and Encrypting in terms of security?

I am implementing a password vault program with java. I have programmed a triple DES for encryption and a SHA256 for hashing. My question is would it make any difference if I first hash the raw data ...
8
votes
3answers
1k views

Increase the security of an already stored password hash

Right now we're using 1024 byte PBKDF2 with 256 byte user-specific salt and variable iterations. However, I would much prefer to be able to, perhaps once every year or two, to be able to flat out ...
1
vote
2answers
242 views

Should hashing hashed hashes colide or not?

Since key stretching basically boils down to hashing hashes over and over again (where salt, pepper and password individualize the hash function, but the principle remains the same), I wonder about ...

1
31 32
33
34 35
40