Questions tagged [salt]
A salt is a random addition to a password to make the hashed password less susceptible to a lookup table attack
0
votes
2answers
180 views
How long does it take to compute hashes using the MD5 hash algorithm? [on hold]
1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds?
2) Will salted and unsalted versions of md5 hash algorithms take approximately the same ...
-1
votes
1answer
98 views
hashcat - cracking a salted sha256
Given a SHA512 hash, a salt, and username I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline without ...
-1
votes
1answer
70 views
Best tool for cracking SHA-1s with unique pre and post salts? [closed]
I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
0
votes
0answers
36 views
Where do salts come from? [duplicate]
A salt can be a random value and length. The hash and the salt are stored in the database.
Is there a separate salt generator function used? Is it just a random generator?
Does it need to be a ...
-1
votes
1answer
126 views
Does salted password hashes expose users with blank passwords?
Traditionally, a 'salted' hash of the password is stored along with the salt so there is no plaintext in the database and still be able to authenticate the password.
The salting process consists of ...
3
votes
2answers
121 views
BCrypt workfactor for salt?
From what I read here: How to securely hash passwords?, you're supposed to iterate the hashing. However in the implementation of BCrypt for .Net uses the workfactor (2^wf iterations) in the '...
1
vote
1answer
59 views
Recover SHA1-encoded email addresses
Say you have a list of SHA1 hashes which are all encoded with the same salt. All of these are email addresses and you know at least one combination of hash and email address.
Is it possible to use a ...
0
votes
0answers
56 views
How do I combine a salt and hash for John The Ripper? [duplicate]
I found a password hash
*61A2BD98DAD2A09749B6FC77A9578609D32518DD
I found a salt somewhere else.
How do I combine these to feed into John the Ripper?
When I run John on the hash (minus the *) John ...
0
votes
1answer
54 views
Implementing SRP without storing the salt anywhere
I am attempting to use SRP to verify clients when they authenticate with a webserver, so that the password is never sent over the wire.
Looking at the SRP procedure, when a client registers with the ...
3
votes
1answer
149 views
Difference in between salt and random padding in cryptography
I would like to know what is difference in between using salt and using "random padding" in cryptography. I am familiar with term salt when we use it with hashing. How does "random padding" differ ...
3
votes
3answers
204 views
How is a pepper used with salted passwords?
How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt?
From Sybex CISSP Official Study Guide, 8th Edition (2018):
Adding ...
2
votes
1answer
110 views
Slow Hashing Without a Salt?
I'm trying to design a security scheme that involves a shared secret but isn't a traditional account password situation. The server would store a set of "keys", each of which has a blob of data ...
3
votes
4answers
326 views
Common format to send encrypted data + IV?
I have an app that receive data from third parties using various protocols: MQTT, HTTP, AMQP, ...
Some clients cannot use TLS (iot devices without TLS support), so we need to find some compact and ...
1
vote
1answer
379 views
Hash a secret API key with a random salt instead of sending sending it alone in REST API
Say, I have an internal https API endpoint used only by me being the admin.
In each each request I send a secret API key for authentication. And I'm fine with this solution.
curl -x PUT .......
-...
3
votes
4answers
976 views
Securing hashes of short enumerated values
The system manages and stores sensitive data of short strings.
Because the sensitive data is of an enumerated type with limited set of well known values, the attacker could easily iterate all the ...
-1
votes
1answer
107 views
How to securely generate and store the salting for password hash? [duplicate]
Assume a client authenticates using the password, which includes hashing and salting. The hash values are stored in a remote database server.
Questions:
For the hash values stored in the database ...
0
votes
1answer
337 views
Generating salt for hash that occurs on server and client
Let's say I have an API call which is supposed to check if email address exists in the DB, without transmitting the actual email address.
For that purpose, I've decided to store SHA256 hash of the ...
1
vote
1answer
5k views
How can I use openssl to decrypt AES-encrypted data using the key and initialization vector?
I am attempting to follow the example in this question:
Where is the salt on the OpenSSL AES encryption?
but I'm having some trouble decrypting using the key and initialization vector.
When I ...
2
votes
1answer
341 views
Why has salt option been deprecated as of PHP 7.0.0?
http://php.net/manual/en/function.password-hash.php
Is that less secured ?
echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT);
=> $2y$12$QjSH496pcT5CEbzjD/vtVeH03tfHKFy36d4J0Ltp3lRtee9HDxY3K
...
3
votes
3answers
158 views
Can one find the value of a “constant salt” if they can set the password and get the hash?
Saying we have an oracle that an attacker can use as many time as they want. The attacker can send a non-empty password to this Oracle. The Oracle hashes the password using sha256(password + pepper), ...
2
votes
1answer
243 views
How to store secret key used for hashing?
I am trying to figure out a secure way to store secret keys used in the hashing of social security numbers.
The idea is for de-identification of research subjects yet still permitting follow-ups ...
3
votes
2answers
132 views
Can hash collisions be eliminated by hashing twice? [duplicate]
Suppose I have a file verified.txt that has a certain hash X.
An attacker can form an impostor.txt that replicates the hash with different content, resulting in a collision for a given algorithm, and ...
0
votes
1answer
112 views
Using the user's GUID-id as a salt for Rfc2898DeriveBytes
I use the Rfc2898DeriveBytes for creating an AES key for protecting the user's data.
For the salt value I would like to use the user's id, which is a guid.
My understanding is, that the only drawback ...
2
votes
2answers
188 views
Does having a salted password hash make cracking an unsalted hash of the same password easier?
I've been asked to implement a system to prevent reusing passwords on the same account.
The most secure way I know to do this is to compare hashes of the password + a known salt. bcrypt.hash(sha256(...
4
votes
1answer
2k views
bcrypt no need to store salt?
I'm confused with bcrypt, I would think I would need to store my salt, and then compare my plain text password + salt to the hashed password, however from documentation it does not look like storing ...
1
vote
1answer
136 views
Should I store my encrypted password's salt and initialization vector as clear text?
I'm encrypting some file with AES-256-CBC, and I'm planning to store the cipher text in a json file, with something like:
{
"data": "0123456789ABCDEF...",
"salt": "00123ABCAABBCCDD...",
"...
2
votes
1answer
266 views
Encrypted data embedded in JPG and Other file types
This is some data found near the end of a JPG file:
18{8uck3y3$}
! 18{b4063c521f76545d8c94e999dd63f445d8c01cfc}
# 18{U2FsdGVkX19RJjdBbDB51ok1hkFXaB91NpZNoQjbVXYlMeMTaWRTdg==}?
Other files on the ...
61
votes
7answers
12k views
Is it safe/wise to store a salt in the same field as the hashed password?
In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"):
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
0
votes
2answers
151 views
How to verify 2 hashed values with different salts originating from the same clear-text password?
I have a project where I need to do an account merge across two websites.
Some percentage of users have accounts on both sites (same email address). Rather than just assume that two accounts with ...
1
vote
1answer
39 views
Store hashes for a finite set of strings that would be extremely time consuming to reverse via table lookup but also allow grouping
Lets say I have finite set of strings (lets say half a billion). There can never be any other strings I would need to store other than these half a billion strings. The strings may be repeated in my ...
1
vote
0answers
36 views
How to get desired output from salt? [closed]
If you wanted to get a specific output from php's $salt. function, how would you do this. By this I mean,
If you know $salt."some_value" gives you desired_value, how do you find that some_value, if ...
1
vote
2answers
162 views
Web Service Authentication Using PBKDF2 and a Public Salt - Does the salt need to change on every request?
I have implemented PBKDF2 authentication for some web services.
The client is given the following information, so they can duplicate the PBKDF2 function:
the hashing algorithm (SHA256)
a secret ...
38
votes
4answers
11k views
Is it safe to check password against the HIBP Pwned Passwords API during account registration?
User registers account on a web app. Passwords are salted and hashed.
But is it safe to check the password against the HIBP Pwned Passwords API, before salting and hashing it? Of course the app uses ...
27
votes
1answer
8k views
How does the attacker know what algorithm and salt to use in a dictionary attack?
I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
0
votes
1answer
111 views
if salt stored in user, will it be possible to use brute force attack? [duplicate]
I had done a lot of research about this topic.
Before Researchs
I found that some people suggest that to hide salt is not important: https://crackstation.net/hashing-security.htm
But also this ...
11
votes
3answers
482 views
Why do salts for hashing passwords need to be globally unique, not just system/site-unique?
I was reading an answer by Terry Chia to another question about the requirements for a salt, in which he/she (among others) specified that salts need to be globally unique, but don't go into any ...
1
vote
2answers
786 views
Is salting a hash more secure than encrypting it?
Assuming most-secure algorithms used for either, what I'd like to understand and get the answer for, is whether a salted hash is more secure than an encrypted hash?
Although similar to this question ...
4
votes
1answer
251 views
Is appending a salt before hash generation enough
I have what I think is a securely generated salt/hashing mechanism for HMAC authentication based on SHA256 in place. However, I'm using the salt in, from what I can see, a fairly standard way of just ...
0
votes
1answer
474 views
Would it be considered good practice to make the salt for a password the hash of the user's username? [duplicate]
I heard it was good practice to have each user have a unique salt, when I'm hashing a user's password with a salt. My question is, can I make my salt a hash of the user's username? Ex.
$username_hash ...
4
votes
1answer
2k views
Hash, salt and best practices [duplicate]
Reading about hashing, salt and pepper, I can't get my head around the following scenario:
If there's a web application and you register on that site, should the password be hashed on the client or ...
1
vote
1answer
718 views
Does storing Base64 encoding of scrypt password hash make it more vulnerable?
Scrypt produces a binary hash of a password. Instead of storing it as bytes directly, we are considering to store the Base64 encoding of this string.
Would that make the password hash more vulnerable ...
1
vote
1answer
649 views
Scrambling a salted password before hashing. Good idea or unnecessary?
I'm updating a legacy classic ASP site and I need to store passwords, so naturally I'm being a bit over cautious about how to go about this given the limitations of Classic ASP.
I'm using both a salt ...
0
votes
0answers
44 views
Password Hashing [duplicate]
I am currently securing the password in PHP using hashing + salt. Before that I only used hashing but recently someone recommended using salts.
My previous code:
$password=hash('sha512',$...
2
votes
3answers
401 views
Solution to calculate and store a hash salt in an open source application?
I was watching this video about how NOT to store a password. I also read this question which is very similar. My question is slightly different in the fact that I'm writing an open source security ...
3
votes
1answer
838 views
How find the hash creation method knowing password, salt, and resulting hash?
If I know the password, the salt (supposed salt actually) and the output hash (sha1 format). How can I find the hash creation method ?
I tried basic stuff like
sha1(salt+password)
sha1(...
0
votes
1answer
745 views
Using MD5 as salt
I know that MD5 is a poor choice for hashing passwords, but its not my ideia.
Imagine that we would use the username as a salting mechanism, wich is also bad idea, but just for an example. First, we ...
1
vote
1answer
82 views
Does changing the scrypt salt have security implications?
I'm using scrypt to stretch a user-supplied password for use as an AES encryption key. The data that's being encrypted with the AES encryption never changes.
I'm aware that if the user changes the ...
2
votes
2answers
253 views
Is mixing password hash and salt in the same database field more secure?
I am storing in my database the user password hash and salt.
I would like to know if putting together hash and salt in the same field is adding complexity to a potential hacker who had access to the ...
0
votes
1answer
292 views
Is my authentication strategy secured?
I want to implement an authentication system by following good practices, i want it as simple as possible and secured (im not going to implement some magic hashing function or something to feel a hero....
1
vote
1answer
111 views
Does the length of Salt data influence how hard or easy it would be to crack/match a hashed password?
Does any guidelines or best practices exist when it come to choose the length of the Salt data. Does it matter in the effort a hack has to put to match the dictionary (or rainbow) table with the ...
