Collaborate Disseminate
I know that PBKDF2 hashes the password a number of times, the result being a key. Can an attacker find the key if they don’t know the password, but know the value of the hash of the password?
Continue reading Can you break PBKDF2 if you know the hash of the password? [migrated]
We are retrieving external users using OpenID with the PKCE flow. We are using the JWT returned from the auth server to authenticate the user. If it is valid, we extract the subject field from the token and use it as an ID in our users tab… Continue reading Can I store subject from a JWT from an external auth server in my DB?
I am researching the state of the art in password security on the web and the general consensus seems to be that server-side hashing with a slow hashing algorithm (Argon2id, bcrypt, scrypt etc) is the best. The idea being that considerable… Continue reading Any studies on the hardware costs of server-side password hashing? [closed]
I found this string
b2335332-d28f-449b-8d00-80a550b43046
Do you think it´s a hash?
If yes any idea which one and if not any other ideas what it could be?
Continue reading Is this 36 character long string a hash [closed]
I am writing a cloud backup system, and want to use a checksum to know if a file has been modified, and accordingly sync it with the server.
This question shows that xxHash is super fast, and this shows that it is significantly worse in te… Continue reading Good checksum algorithm for backup / cloud sync system
Since PHP has loose type comparison, we have:
php -r ‘var_dump("1234e03"=="1234000");’
bool(true)
And since MD5 hashs are often reprensented as hexa string like 713f44b3d2c680df02eb5a0bde86fcd7
Are there two already kn… Continue reading Do we know a MD5 collision exploiting PHP loose type comparision (0123e2 == 123e02 == 012300)?
First I am very bad in cryptographic algorithms.
I found online that Argon2 is more secure than SHA-512, so I used it for password hashing.
There’re recommended options for Argon2:
Memory: 4Gb
Iterations: 4 or more
On my ancient server i… Continue reading Argon2 vs SHA-512, what’s better in my case?
For my job I use some industry-specific software that stores sensitive information. The software has a web interface with a public login page. One time I attempted to log in, but mistyped the last few characters of my password. To my surpr… Continue reading Potential problems with insecure password hashing
Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work?
Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum for it.
My understanding is that this is… Continue reading Is signing a file better than issuing a checksum, and does it render a separate checksum useless?
I have seen that for RSA2K the hash function SHA-256 has been used.
Now my question is if I want to use RSA3K, should I change the size of the hash function for example from SHA-256 to SHA-384? Is there a relationship that one needs to con… Continue reading Is there a relationship between the size of RSA key and size of hash function?