Collaborate Disseminate
I have a hash H1 and a password P1. The hash is MD5. I have another hash H2 without a password. Can I leverage my knowledge of H1 and P1 to get a key? can I use this key to decrypt H2? Are there recommended tools? Thanks!
I want to hash email addresses so that they are anonymous but still unique in my database. I was thinking of using scrypt for this and creating the salt as a sha256 of some secret stored on the server + their email address. Implementation … Continue reading Hashing email addresses using scrypt
I know that PBKDF2 hashes the password a number of times, the result being a key. Can an attacker find the key if they don’t know the password, but know the value of the hash of the password?
Continue reading Can you break PBKDF2 if you know the hash of the password? [migrated]
We are retrieving external users using OpenID with the PKCE flow. We are using the JWT returned from the auth server to authenticate the user. If it is valid, we extract the subject field from the token and use it as an ID in our users tab… Continue reading Can I store subject from a JWT from an external auth server in my DB?
I am researching the state of the art in password security on the web and the general consensus seems to be that server-side hashing with a slow hashing algorithm (Argon2id, bcrypt, scrypt etc) is the best. The idea being that considerable… Continue reading Any studies on the hardware costs of server-side password hashing? [closed]
I found this string
b2335332-d28f-449b-8d00-80a550b43046
Do you think it´s a hash?
If yes any idea which one and if not any other ideas what it could be?
Continue reading Is this 36 character long string a hash [closed]
I am writing a cloud backup system, and want to use a checksum to know if a file has been modified, and accordingly sync it with the server.
This question shows that xxHash is super fast, and this shows that it is significantly worse in te… Continue reading Good checksum algorithm for backup / cloud sync system
Since PHP has loose type comparison, we have:
php -r ‘var_dump("1234e03"=="1234000");’
bool(true)
And since MD5 hashs are often reprensented as hexa string like 713f44b3d2c680df02eb5a0bde86fcd7
Are there two already kn… Continue reading Do we know a MD5 collision exploiting PHP loose type comparision (0123e2 == 123e02 == 012300)?
First I am very bad in cryptographic algorithms.
I found online that Argon2 is more secure than SHA-512, so I used it for password hashing.
There’re recommended options for Argon2:
Memory: 4Gb
Iterations: 4 or more
On my ancient server i… Continue reading Argon2 vs SHA-512, what’s better in my case?
For my job I use some industry-specific software that stores sensitive information. The software has a web interface with a public login page. One time I attempted to log in, but mistyped the last few characters of my password. To my surpr… Continue reading Potential problems with insecure password hashing