Linked Questions

8 votes
1 answer
59k views

Is SHA-256 safe and difficult to crack? [duplicate]

I am trying to crack a SHA-256 hash but I am not sure how to approach this in an efficient way. The following is known of the original non-hashed content: 64 characters long only consists 0-9 and a-z ...
Matthew Kaufmann's user avatar
41 votes
3 answers
51k views

What are preimage resistance and collision resistance, and how can the lack thereof be exploited?

What is "preimage resistance", and how can the lack thereof be exploited? How is this different from collision resistance, and are there any known preimage attacks that would be considered feasible?
John Gietzen's user avatar
  • 1,505
25 votes
3 answers
973 views

What differentiates a password hash from a cryptographic hash besides speed?

I understand that password hashes like bcrypt have the principal property of taking a long time to run, but I'm wondering what if anything about password hashes make them superior to merely running a ...
Steven's user avatar
  • 353
23 votes
3 answers
3k views

Is using slow password hashing on the client side easier attackable than on the server side?

As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
Paŭlo Ebermann's user avatar
12 votes
4 answers
4k views

Can I determine if a user has the wrong symmetric encryption key?

We're using the Objectivity/DB object database with a custom encryption plugin that encrypts serialized objects on disk. Encryption uses AES with a shared secret key held by all users. I would like to ...
Barry Wark's user avatar
13 votes
3 answers
2k views

Password entropy much lower than entropy of encryption keys. Why is this acceptable?

When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner. When talking passwords however, the standard these days is ...
Minaj's user avatar
  • 1,090
9 votes
4 answers
2k views

Hashing a password before using for online accounts

I don't actually know what I'm talking about, so apologies if I get anything wrong. At the moment I have a password naming system for most of my online accounts that looks something like this: ...
jerboa88's user avatar
  • 193
4 votes
3 answers
3k views

How can mega store my login details and still be secure?

I understand how Mega's encryption works. For a quick summary of all those in the future looking for an answer on this... here is how it works: Upon first signing up for an account you make a ...
jduncanator's user avatar
7 votes
2 answers
2k views

What would be a really secure way to encrypt sensitive data on a web site

The problem I need to encrypt sensitive client information in my site and make sure that even in the worst case scenario that the site gets hacked the information cannot be retrieved. (I guess is ...
Nestor Mata Cuthbert's user avatar
6 votes
1 answer
6k views

Recommended password complexity for SSH key encryption using AES-256-CBC

When protecting SSH private keys with password-based encryption, what would be a good minimum password complexity+length standard to make cracking the password too difficult to be worthwhile anytime ...
sa289's user avatar
  • 163
4 votes
2 answers
794 views

A patched SHA1 attempt for password verification

This is a classical scenario: For our web based authentication platform we have a username and a password field. User enters these values and presses Log In. The browser gathers the user data, ...
Ferenc Deak's user avatar
3 votes
2 answers
2k views

Key derivation from a random seed

The main problem is to use a block cipher to generate a random key. I would like to generate 256-bits key which can be as random as possible. I generate it in the following way: Pick a plaintext $...
Hashed's user avatar
  • 185
1 vote
1 answer
5k views

Key-size of encryption method

Is there a definied keysize to be used with the "AES_256-CBC" method in PHP, and what is the size? Some background: I want to store encrypted text into a PostgreSQL database. The user who posts the ...
stUrb's user avatar
  • 113
3 votes
3 answers
2k views

Question regarding multiple SHA-256 rounds on a Bitcoin Brain Wallet passphrase…

I am attempting to come up with a way of memorizing a seed that could lead to any number of brain wallets for bitcoin. I need multiple wallets because a) I don't want all my eggs in one basket, and b)...
james853's user avatar
7 votes
1 answer
2k views

What is wrong with simple concatenation in salted password hashes?

I once heard that if implementing a password hashing scheme, simply concatenating the password and salt together before hashing could lead to some subtle vulnerabilities, and I'm trying to figure out ...
IanPudney's user avatar
  • 173
3 votes
2 answers
448 views

Idea for user/pass hashing to prevent rainbow tables, would it work?

I'm very new to cryptography (and security in general, for that matter), but I had an idea that I'm sure is very flawed, but is worth asking. If a computer user, online account, etc, needs to verify a ...
tkbx's user avatar
  • 181
3 votes
2 answers
715 views

Hash based code obfuscation?

The code if(str1 == "abc") {} can be converted to if(hash(str1) == 0x8732e) {} // assume hash("abc") == 0x8732e to ...
Infinite's user avatar
  • 133
5 votes
1 answer
685 views

Why don't we use bcrypt and scrypt together?

Everyone is comparing bcrypt to scrypt. Bcrypt is proven, lots of cryptoanalysis and no vulnerabilities so far, but uses very low memory. While scrypt uses a lot of memory, but it's too early in its ...
Zoltan Zaikosz's user avatar
2 votes
2 answers
966 views

Is it worth hiding an AES encrypted text string in a PNG image for better security?

I need advice as to whether it is worth the extra "security" and processing of an AES encrypted text string to be hidden in a PNG image as opposed to an AES encrypted text string to be saved in a read-...
DaNCh's user avatar
  • 23
2 votes
1 answer
622 views

Extension of a password hashing algorithm using Fibonacci

I am right now taking a class named Applied Cryptography and our final project is to create a password hashing method using at least one existing algorithm and then add additional steps to make it ...
Yatiac's user avatar
  • 121
4 votes
1 answer
357 views

salting with password hash to improve security?

Would something like the following improve security (against rainbow attacks, not brute force)? Assume that $P$ is a user-chosen password, and the objective is to obtain a hash $H$ for password ...
nonchip's user avatar
  • 153
0 votes
1 answer
281 views

Capital passphrases with rainbow tables?

I'm currently trying to learn how rainbow tables work for a personal project of mine, but I am a little bit confused on how passphrases can be found. Here are the steps that seem do this, from the ...
DecanalGossypine27's user avatar
3 votes
1 answer
154 views

Can the salting function complexity improve the hash robustness?

I'm quite novice in security, and all examples I saw seem to salt the password by concatenating it, or by applying a simple binary OR or XOR. So the hash is based on "salt + password", "salt | ...
Xavier Portebois's user avatar
2 votes
1 answer
145 views

Tips on conceiving safe software messaging platform

I have a personal project in mind in which I plan to use cryptography in order to let the users be confident in the fact that, even if all data get's stolen, it would be virtually impossible to crack ...
Berzemus's user avatar
  • 175
1 vote
1 answer
122 views

How to take SHA-1 safely for my particular case?

Let me ask about my toy passwords generator program X5 which I want to improve. X5 uses a secret key and a public key to generate a password.Where any public key is supposed to be known to hackers in ...
seven_swodniw's user avatar
0 votes
1 answer
57 views

Is there a crypto function that would take 1 second to run?

Short version of the question: what if we encrypt or decrypt by running SHA-256 one million times repeatedly, beginning with the initial "phrase" or "object", so that the operation ...
nonopolarity's user avatar