133 votes

How do hashes really ensure uniqueness?

The simple answer is that hashes don't ensure uniqueness. Very broadly, hashes behave like "deterministic random numbers" – deterministic in the sense that hashing the same data always ...
David Richerby's user avatar
38 votes
Accepted

Why use argon2i or argon2d if argon2id exists?

The current Argon2 draft RFC, I think, provides a good, reasonably brief answers to this question. TL;DR: most people will indeed want to use Argon2id and not the "pure" variants. The ...
Luis Casillas's user avatar
35 votes
Accepted

Boss insists on storing SHA2(p) || SHA3(p), claiming it "doubles security"

"nobody has a rainbow table for [this scheme]" Well, this is a huge claim so needs justification. Building a rainbow table is not hard. Once you are a target, the table will be ready. For ...
kelalaka's user avatar
  • 48.3k
33 votes

How do hashes really ensure uniqueness?

Firstly, some definitions; Pre-image resistant: given a hash value $h$ find a message $m$ such that $h=Hash(m)$. Consider storing the hashes of passwords on the server. Eg. an attacker will try to ...
kelalaka's user avatar
  • 48.3k
32 votes
Accepted

Would this be considered a secure password hash?

Except for the iteration amount ( we can argue that is small, too ‡ and some entropy loss *), the answer is no! There is no memory hardness that mainly prevents massive ASIC/GPU searches There are no ...
kelalaka's user avatar
  • 48.3k
31 votes
Accepted

What password hash function for the next 50 years?

None. Cryptographic hashes are not directly suitable to store password hashes. You should use a password hash (also known as a Password Based Key Derivation Function or PBKDF if it is used to derive ...
Maarten Bodewes's user avatar
  • 92.4k
29 votes
Accepted

When to use Argon2i vs Argon2d vs Argon2id?

If you are unsure, then always choose Argon2id. Only choose Argon2d if you need maximum security at the expense of side-channel risk, and only choose Argon2i if side-channel attacks are the primary ...
forest's user avatar
  • 15.2k
27 votes
Accepted

Storing Parameters In Argon2 Hash As Potential Security Issue?

First, following the "next big thing" is not generally a good idea in the world of cryptography. You should strongly prefer battle-tested code and algorithms over new ones. In this particular case, ...
Stephen Touset's user avatar
26 votes
Accepted

Mixing algorithms for password hashing good or bad?

Does this look like it's done by someone who knows what they're doing or is it just a case of someone throwing all the algorithms they find together and hoping it's a good solution? This is obviously ...
Gilles 'SO- stop being evil''s user avatar
25 votes
Accepted

What is the recommended number of iterations for Argon2?

I'm wondering what the recommended number of iterations would be? Unlike bcrypt or traditional crypt, argon2 does not have a single iteration count, but three parameters affecting the computational ...
otus's user avatar
  • 32.1k
24 votes
Accepted

Is there a hash function that's more expensive for an attacker than for the server?

That's is an interesting idea (that was new to me) and turns out to be known as (random) peppering, as pointed in these comments. Indeed, the average number of evaluations of $H'$ by the server when ...
fgrieu's user avatar
  • 140k
21 votes

Why are good passwords required if we use good hashing algorithms?

First of all, password strength rules like "at least 12 chars, numbers, signs, upper and lowercase" are actually counterproductive — they result in passwords that are only slightly harder to guess but ...
Ilmari Karonen's user avatar
19 votes
Accepted

Does the Balloon hashing paper deprecate Argon2?

Does the recent Balloon hashing paper and the included attack on Argon2 effectively negate the result of the Password Hashing Competition? No. The main result of the PHC was not a single new ...
SEJPM's user avatar
  • 45.9k
18 votes

Can you use a hash as a password?

I'd say the key thing that you need to spell out to answer this question is this: What information does the attacker have? This ties to one of the basic concepts of cryptography, called Kerckhoffs'...
Luis Casillas's user avatar
18 votes
Accepted

Why did Argon2 win the PHC?

I have been part of several cryptographic competitions (AES, eSTREAM, SHA-3, PHC). In every single one of them, some people worded bitter reproaches and wailed and whined about the unfairness of the ...
Thomas Pornin's user avatar
18 votes

Password hash that can be upgraded without plaintext password

This is called Client-Independent Update, according to the Catena paper. It is desirable to be able to compute a new password hash (with some higher security parameter) from the old one (with the ...
Sjoerd's user avatar
  • 671
18 votes
Accepted

Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw

You should not be hashing it before passing to bcrypt, which is designed to do the hashing and key-stretching work itself. It's choking on the hash result because it's expecting a redundant, mushy, ...
JamesTheAwesomeDude's user avatar
16 votes
Accepted

Why is PerfectForwardSecrecy considered OK, when it has same defects as salt-less password hashing?

Salt-less password hashing is only a problem since the amount of passwords actually used in practice is comparably small and also not evenly distributed. Thus it is both in terms of time and memory ...
Steffen Ullrich's user avatar
15 votes

How do hashes really ensure uniqueness?

... its practically impossible to recreate a hash that for any foreseeable endeavor its fine or is there some element that I'm missing that reduces even that extremely low probability to zero? The ...
Maarten Bodewes's user avatar
  • 92.4k
14 votes
Accepted

Why do we use hex output for hash functions?

Hexadecimal is traditional -- by this, I mean that there first were command-line tools that used hexadecimal for output, then other people using the hash functions found it fit to stick to hexadecimal,...
Thomas Pornin's user avatar
14 votes
Accepted

Password entropy much lower than entropy of encryption keys. Why is this acceptable?

I know that humans would find it impossible to maintain a 128 bit password -- however, I wonder if there is some technical reason why a 52 bit password would not be as weak as a 52-bit encryption key ...
otus's user avatar
  • 32.1k
12 votes
Accepted

Do I need to use a CSPRNG when creating salts for user accounts?

Answering your question If an attacker has access to a copy of my users database table containing each salt and the related salted password, I can't understand how a CSPRNG would be more secure than ...
e-sushi's user avatar
  • 17.9k
12 votes
Accepted

How is the quality of a password calculated and what does it mean?

How much entropy is enough? For a password, something around truly 96-bits of entropy is enough. After all password usually go through some slow password hashing which increases the work load for ...
SEJPM's user avatar
  • 45.9k
12 votes

Why did Argon2 win the PHC?

I agree with Thomas Pornins answer, but there was one remarkable criticism on the panel. Round two of the competition actually allowed only minor tweaks. Argon switched to Argon2, which was more a new ...
BeloumiX's user avatar
  • 995
12 votes

Password Hashing Security Using Scrypt & Argon2

This home-made construction is pointless and unnecessarily complex, Complexity is often the source of vulnerabilities. In this case, for example, I’ll wager you’re not securely handling the ...
rmalayter's user avatar
  • 2,297
12 votes
Accepted

Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password?

Does having a hash of a password jeopardize the security of plaintext that was encrypted with that password? As usual in password-based cryptography, we'll consider that the password was chosen from ...
fgrieu's user avatar
  • 140k
10 votes
Accepted

Does a big salt have the same memory effects as Bcrypt?

So in general, isn't this equivalent to what Bcrypt and PBKDF2 do in terms of password storage security? PBKDF2, yes, pretty much. The only real difference is that salt/password are used the other ...
otus's user avatar
  • 32.1k
10 votes

Is the SHA1 hash of MD5 hash of a password secure?

Pros: The only pro is that your method is very slightly better than storing passwords in plaintext. Cons: If an attacker gains access to your database, he will easily be able to recover 99% of ...
bkjvbx's user avatar
  • 1,554
10 votes
Accepted

Whats the deal with argon2?

It has been implemented, of course. In addition to the reference implementation, there are some crypto libraries with it like libsodium. It has not yet seen much use in applications or protocols, ...
otus's user avatar
  • 32.1k

Only top scored, non community-wiki answers of a minimum length are eligible