New answers tagged

2

Can you guarantee that the users are going to use high-strength passwords like dicewire? What if they are using simple passwords? Are they going to sue you when they are hacked and their data exposed? Lots of questions? Consider that all of your users are hacked due to a bug in your application, then the attackers can execute a batch attack, too. Using salts ...


2

If you only send the root and the Merkle tree is just used for parallel hashing then it doesn't matter how the tree is written down. The algorithm works even if you have the intermediate nodes describe $\operatorname{hash}(L1) | \operatorname{hash}(L2)$ instead of $\operatorname{hash}_1 | \operatorname{hash}_2$ as they are fully equivalent. In the end only ...


4

Merkle Tree is based on hashing to the root to provide an efficient digital signature. If the leaves just contain a single data then the parents cannot contain the hash of both children and the combined hash in a simple node design. This can complicate the structure and programming so that the last parents must contain the hash of their children and their ...


1

Coming back to answer this since I see someone is wondering if I was able to do it. The professor, seemingly realizing that this assignment wasn't possible in the time given, gave another hint that made this doable. The plaintext is 8 characters long The first character and last two characters are lowercase There are two digits, and the rest of the password ...


2

Linux uses "sha512crypt", which isn't memory-hard but is fine given a moderately strong input passphrase. HMAC-SHA256 isn't a password-hashing algorithm. It's not even a hash function. It requires a uniformly-random secret key which it uses on a message to produce a Message Authentication Code (tag) of that message under that key. The password-...


1

The bcrypt hash value consists of the following parts: $2b — this indicates that the hash is generated according to the OpenBSD implementation of bcrypt. 10$ — this is the "cost" parameter, indicating that the password is hashed with 210 (i.e. 1024) iterations of the blowfish cipher. A higher cost parameter results in password hashes that are ...


0

if you know the plaintext and hash password, then you can try below..for ex. your password is 'code3' and it is hashed with SALT generate by bcrypt.gensalt() hash_word=bcrypt.hashpw(word.encode('utf-8'),bcrypt.gensalt()) hash_word = b'$2b$12$C3reFNd9UBYHeb3/2ZbBk.yQ1cDowSulDHQIkWymx.WdoJ72yHKeu' because salt is in the hash_word , while testing you can ...


1

Salt ( a.k.a $CaCl_2$) is added before hashing to prevent rainbow attacks. So each password will be appended to a unique salt before hashing and if the server is hacked and the hashes are leaked, a hacker will have hard time un-hashing with rainbow tables. Salting has no use in encryption/decryption because it serves no purpose.


Top 50 recent answers are included