Hot answers tagged

58

The SHA-3 hash competition was an open process by which the NIST defined a new standard hash function (standard for US federal usages, but things are such that this will probably become a worldwide de facto standard). The process was initiated in 2007. At that time, a number of weaknesses and attacks had been found on the predecessors of the SHA-2 functions (...


30

This is almost a perfectly fine practice, but it has a bit of a flaw. In general, a hash is just a numeric value, and you can express it in whatever base you please. For example, you could convert your hash to binary and express it as base64: 2 6 b a ... | | | | 0010011010111010 ... | | T u However, the serious ...


12

There is no objective, systematic and consistent notion of what is a "round". Each algorithm specification defines things its own way. MD5 is described as first padding and then splitting its input into 512-bit blocks. Then, as the RFC puts it, there are four rounds where each round happens to be a sequence of 16 very similar operations. So we could say ...


12

From what I can see, this isn't truncation at all. Each 12-bit section (3 ASCII hex characters) is converted to its equivalent base62 representation, which is a bijective operation. You can take the values on the right and turn them back into the values on the left. The operation doesn't truncate the value, but rather reduces its resultant length by using a ...


10

Hash functions typically work by performing a single operation over and over. Each time through is called a "round". It's a bit like stirring a pot: you can't expect to thoroughly mix anything with just one turn of the spoon. But stir long enough and the original state of the ingredents can no longer be determined. Here's an example of a round of SHA-1. A ...


10

Bcrypt is marginally "better" than PBKDF2. However, PBKDF2 is already quite fine: used properly, it ceases to be the weakest point in your system. Remember that the point of the iterations in PBKDF2 is to make the password hashing slow for the attacker. Unfortunately, it makes it slow for you, too. You thus need to avoid making it unduly slow for you. In ...


10

There's at least one usage for which SHA-2 is seemingly better than SHA-3 and that's key stretching. SHA-3 was designed to be very efficient in hardware but is relatively slow in software. SHA-3 takes about double the time compared to SHA-2 to run in software and about a quarter of the time to run in hardware. Since SHA-3 takes double the time to run in ...


9

I'd go for the in-built Rfc2898DeriveBytes, with a high number of iterations - the higher the number the better, but I'd recommend 5000 as an absolute minimum. SHA1 is considered broken for some uses, but not in the way it's used in PBKDF2, and probably won't ever be within the lifetime of your product. Implementing your own PBKDF2 with SHA512 shouldn't be ...


8

First of, a hash function has an input: you hash something. GUID (actually UUID) don't have any input. To generate "unique identifiers" with a hash function, you just don't use a hash function; you have to define what you are actually hashing. There are several standard methods for generating UUID; all these methods aim at achieving "uniqueness" of the ...


7

Lets get some ground rules out of the way. SHA512 isn't an encryption function, its a hash function. PBKDF2 (Assuming you are using the newer 2nd variant...) isn't a hash function or an encryption function, its a way of using a hash function and is commonly used to generate the key for an block cipher or stream cipher. In most situations I don't think ...


7

For preventing interception and reading of the secret content, encryption algorithms like AES are used. HMACs do not matter at all for this part. Assuming AES (CBC etc.) is secure, an attacker could still intercept what you're sending or receiving, but he can't read it. What he could do, however, is to change the data to something else. Again assuming AES ...


6

Personally, I would go ahead and use BCrypt. The algorithm may not be NIST-listed, but it's been around long enough (13 years now, and the Blowfish cipher itself almost 20) that I'd trust it. By comparison, MD5 was shown to be vulnerable a mere 5 years after its introduction and was considered completely broken in 18 years. The only known attack on the ...


6

On the 2nd of October, 2012, NIST decided what algorithm was going to be used to perform hashing. This was the Keccak algorithm. The Keccak algorithm is based on the hermetic sponge strategy. It's the new standard algorithm. We use standards to make have better compatibility. Keccak was designed by Guido Bertoni, Joan Daemen (one of the creators of AES), ...


6

Possibly, but given their size - much more likely to download a generation tool and a word pattern list. Rainbow tables are a carefully comprised collection of dictionary words and probable combinations in order to save on space. A rainbow table sufficient for alphanumerical passwords of up to 9 characters is 864 GB in size. A rainbow table for this level ...


6

The site does only provide a rainbow table (a lookup of the possible text from the hash). So it is simple a database with all hashes saved (so far because a user has entered the text for the searched hash before). If you enter a hash value (e.g. ...


5

Simple Answer: Rainbow Tables This site save every Hashvalue you Entered to Hash it. So it could reverse search it in his own database.


5

Which algorithm is best depends on what you're using it for. If you're trying to spot random data corruption, for example, a blindingly-fast algorithm like CRC-32 is ideal. On the other hand, if you're trying to secure password hashes, you want an inherently slow algorithm like bcrypt. For protecting data transfers against malicious tampering, you want a ...


4

Recomputing secret from SHA-1(secret || suffix1) (for any known value of suffix) would constitute a preimage attack. No preimage attack faster than luck is currently known for SHA-1 ("luck" works in average effort 2160 for SHA-1, i.e. totally infeasible). You won't get the secret value. However, if your goal is to compute SHA-1(secret || suffix2) then that ...


4

The purpose of a salt is not to make computing the hash slower, it's to prevent rainbow tables from being useful. A single iteration of SHA512 is way too fast to be useful against bruteforcing attacks. On a decent GPU, you can do ~100M hashes/sec (new link) with SHA512. Multiply this for systems with multiple GPUs. With a slow KDF such as bcrypt, you can ...


4

There is no technical reason that would prevent a CA from issuing a certificate with a SHA-256 signature, even if the CSR was signed by the requestor using some weaker signature algorithm. The purpose of the signature in the CSR by the requestor is to prevent someone from requesting a bogus certificate containing someone else's public key. It is the ...


4

I believe that in this context yoroshiku can be rendered as the hope of a long and productive presence on Security.StackExchange :-). So, Welcome! You are partially correct in your understanding of the collision problem; the risk exists, but if the algorithm has a "flat" enough output, the risk is essentially the same whatever the number of rounds. The "...


4

Well, in theory explicitly using SHA256 outputs as input limits the amount of possible inputs, but the huge(!) number of SHA256 outputs makes this a negligible factor. Knowing this provides no real advantage (as far as we know today), as the hash output is pretty much pseudo-random. There shouldn't be much difference between all possible SHA256 outputs and ...


4

As long as first hash isn't horribly broken (and I mean broken so badly that it's significantly worse than MD5) this doesn't weaken the bcrypt hash in any notable way. In fact, performing a round of SHA256 before bcrypt is actually recommended sometimes because bcrypt silently truncates at 72 characters. While 72 characters should be more than enough for a ...


4

No, this is not possible with hashes. Hashes are specifically designed to prevent this, otherwise attacker wanting to obtained the hashed value could start by checking first letter, then the next... Also, you are likely using salt wrong.


3

The text means "simple" by opposition to what was used in the older traditional DES-based crypt() where the salt was a 12-bit value, represented as exactly two characters in a restricted set. Ulrich Drepper wants to say that his creation is less picky and can take as salt any sequence of up to 16 bytes. Though the hashing function itself can work with any ...


3

One benefit I see of SHA-3 over SHA-1 and SHA-2 is that it is not sensitive to extension attacks. That means that protocols based on it (e.g. MACs) are inherently more robust.


3

A GUID is a random unique identifier you generate and then assign to something. "oh, you're so cute, I think I'll call you Charlotte" (only Charlotte is random). A MD5 checksum is something already inherent to the object that can be identified by anyone. "Hey look, according to this scale, Charlotte weighs 25 pounds". A UUID is interchangeable in some ...


3

When in doubt, use SHA-256. This is the default answer for situations where you need a generic hash function; for specialized cases such that hashing passwords, the situation is different: you don't want to use MD5 or SHA-1 or SHA-2 or SHA-3 for passwords, but something like bcrypt. SSL is a deployed standard with a long history, and typically uses SHA-1. ...


3

To put you on the right track, we must first take you out of the wrong track. In your case: If you think "268 + 268 + 108", then you are thinking wrong. That would be the count of possible passwords, assuming that a password is either a sequence of eight uppercase letters, OR a sequence of eight lowercase letters, OR a sequence of eight digits. But that's ...


3

"Truncate" means to remove a portion altogether. In this example, if I truncated the right half of the hash characters, the remainder would look like this: 26ba0a896923d2de4cad532a3f05da72 So yes, truncation will increase your collisions, but that's not what is happening here.


Only top voted, non community-wiki answers of a minimum length are eligible