Linked Questions

23 votes
3 answers
3k views

Is using slow password hashing on the client side easier attackable than on the server side?

As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
0 votes
1 answer
57 views

Is there a crypto function that would take 1 second to run?

Short version of the question: what if we encrypt or decrypt by running SHA-256 one million times repeatedly, beginning with the initial "phrase" or "object", so that the operation ...
13 votes
3 answers
2k views

Password entropy much lower than entropy of encryption keys. Why is this acceptable?

When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner. When talking passwords however, the standard these days is ...
0 votes
1 answer
285 views

Capital passphrases with rainbow tables?

I'm currently trying to learn how rainbow tables work for a personal project of mine, but I am a little bit confused on how passphrases can be found. Here are the steps that seem do this, from the ...
41 votes
3 answers
51k views

What are preimage resistance and collision resistance, and how can the lack thereof be exploited?

What is "preimage resistance", and how can the lack thereof be exploited? How is this different from collision resistance, and are there any known preimage attacks that would be considered feasible?
3 votes
3 answers
2k views

Question regarding multiple SHA-256 rounds on a Bitcoin Brain Wallet passphrase…

I am attempting to come up with a way of memorizing a seed that could lead to any number of brain wallets for bitcoin. I need multiple wallets because a) I don't want all my eggs in one basket, and b)...
7 votes
2 answers
2k views

What would be a really secure way to encrypt sensitive data on a web site

The problem I need to encrypt sensitive client information in my site and make sure that even in the worst case scenario that the site gets hacked the information cannot be retrieved. (I guess is ...
3 votes
2 answers
715 views

Hash based code obfuscation?

The code if(str1 == "abc") {} can be converted to if(hash(str1) == 0x8732e) {} // assume hash("abc") == 0x8732e to ...
9 votes
1 answer
59k views

Is SHA-256 safe and difficult to crack? [duplicate]

I am trying to crack a SHA-256 hash but I am not sure how to approach this in an efficient way. The following is known of the original non-hashed content: 64 characters long only consists 0-9 and a-z ...
4 votes
3 answers
3k views

How can mega store my login details and still be secure?

I understand how Mega's encryption works. For a quick summary of all those in the future looking for an answer on this... here is how it works: Upon first signing up for an account you make a ...
7 votes
1 answer
2k views

What is wrong with simple concatenation in salted password hashes?

I once heard that if implementing a password hashing scheme, simply concatenating the password and salt together before hashing could lead to some subtle vulnerabilities, and I'm trying to figure out ...
9 votes
4 answers
2k views

Hashing a password before using for online accounts

I don't actually know what I'm talking about, so apologies if I get anything wrong. At the moment I have a password naming system for most of my online accounts that looks something like this: ...
3 votes
1 answer
154 views

Can the salting function complexity improve the hash robustness?

I'm quite novice in security, and all examples I saw seem to salt the password by concatenating it, or by applying a simple binary OR or XOR. So the hash is based on "salt + password", "salt | ...
2 votes
2 answers
968 views

Is it worth hiding an AES encrypted text string in a PNG image for better security?

I need advice as to whether it is worth the extra "security" and processing of an AES encrypted text string to be hidden in a PNG image as opposed to an AES encrypted text string to be saved in a read-...
6 votes
1 answer
6k views

Recommended password complexity for SSH key encryption using AES-256-CBC

When protecting SSH private keys with password-based encryption, what would be a good minimum password complexity+length standard to make cracking the password too difficult to be worthwhile anytime ...

15 30 50 per page