0
$\begingroup$

I feel foolish asking this, but will the hash generated by SHA-1 or other encryption methods ever have the possibility of containing a quote? Or any other characters that may be escaped such as ", ', and \

I am attempting to make a non-MySQL database to hold values such as hashes (and yes, I am aware that it is not the most secure option for holding things such as passwords; this is just a private endevour for fun). I was planning to store the tables and data in JSON files, so that is why I need to know if I will need to escape some characters before storing the data.

$\endgroup$

closed as off-topic by tylo, Gilles, e-sushi, DrLecter, Henrick Hellström Mar 9 '15 at 2:18

  • This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    $\begingroup$ This question would probably be better on security SE, because it aims at possible problems with using crypto libraries in databases and web technologies. $\endgroup$ – tylo Mar 6 '15 at 15:54
  • 2
    $\begingroup$ I'm voting to close this question as off-topic because it is about programming, with cryptography only involved tangentially. It would be on-topic on Stack Overflow. $\endgroup$ – Gilles Mar 7 '15 at 17:50
  • $\begingroup$ I'm voting to close this question as off-topic because this is an apples and oranges kind of question. SHA-1 will output a string of 160 bits. A quote character is a character and not a bit. Your question will only make sense, if there is an implied conversion algorithm from the bit string output of SHA-1, to the character string you store in your database. This conversion algorithm might be chosen independently of the hash algorithm. Hence, your question is off-topic. $\endgroup$ – Henrick Hellström Mar 9 '15 at 2:18
4
$\begingroup$

SHA-1 (and, in general, any modern cryptographical method) will generate an arbitrary bitstring. The bit string 0x22 (the ASCII code for double quote) is as probable as any other bitstring.

You could attempt to detect (and escape) such byte values; another possibility is convert the bitstring into hex or base-64; those have a deterministic size, and may be a bit easier to place into the database.

$\endgroup$
2
$\begingroup$

The hash output is a random string of a length specified by the function (that is 160 bits for SHA-1). It may contain any special characters, including e.g. white space.

It is more common to encode the value in hex than to use quoting of special characters are special characters are very common in hash output (minority of characters would be ASCII if no encoding was applied). Encoding in hex also helps in making the length of the output of hash function fixed number of characters, which is useful. Occasionally base64 encoding (or its variant) is used instead of hex. For the best use of storage, it may be good to store the field in binary and just apply the encoding (e.g. hex) when displaying the value of the field.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.