basically, most of the new websites does not have a big amount of money (that includes me) for doing a high-standard-level-like password hashing, I read a lot says that other password algorithms/hashing uses a lot of memory in GPU or big-sized hashes? Currently I am using sha256, $str, $salt type of hashing, one of the website posted an article that what I am using is not recommended, I also PBKDF2 alot, but when I read how to do it. It includes sha256/mcrypt_create_iv/md5 etc. I do not understand. So can you give me, what does new websites need for that is low-budget and lowe-sized methods  IS THIS CODE SAFE? I MEAN NOT THAT UNSAFE? is this is okay? is this weak ?  &lt;?php class Hash {     public static function make($string, $salt = '') {     return hash('sha256', $string . $salt); }  public static function salt($length) {     return mcrypt_create_iv($length); }  public static function unique() {     return self::make(uniqid());  }   }  please give me advices and opinions THANK YOU!
1417
It is currently said that MD5 is partially unsafe. Taking this into consideration, I'd like to know which mechanism to use for password protection.  This question,   suggests that hashing multiple times may be a good idea, whereas  suggests using salt.  I'm using PHP. I want a safe and fast password encryption system. Hashing a password a million times may be safer, but also slower. How to achieve a good balance between speed and safety? Also, I'd prefer the result to have a constant number of characters.   The hashing mechanism must be available in PHP It must be safe It can use salt (in this case, are all salts equally good? Is there any way to generate good salts?)   Also, should I store two fields in the database (one using MD5 and another one using SHA, for example)? Would it make it safer or unsafer?  In case I wasn't clear enough, I want to know which hashing function(s) to use and how to pick a good salt in order to have a safe and fast password protection mechanism.  Related questions that don't quite cover my question:
83837
On a  (Leopard) PowerPC, if I do: echo "hello" | md5  on the command line, the result is:  b1946ac92492d2347c6235b4d2611184   But if I enter hello into one of the online MD5 hash sites like , I get:  5d41402abc4b2a76b9719d911017c592   Am I doing something wrong? If I want to use MD5 on the go, how can I make sure what I'm getting on the command line will agree with the online md5 tools?
16115
So, I was having this weird thought. If the checksums(MD5 or SHA...) are unique to any file and are modified if any part of the file is edited, why cant the checksums be decoded back to get the original file? That is if I want to send a large(say 700MB) video, instead I could send just the hash and the file be decoded locally in my friend's computer. I know the thought is stupid, but is it possible by any chance? Or am I missing some thing here? And forgive me if I'm wrong, I ain't a professional.
89837
There is a lot of confusion between hash- and encryption algorithms; I would like to understand:   When do we use a hash algorithm and when do we use an encryption algorithm (a cipher)? How difficult it is to reverse hash- and encryption algorithms? From the theoretical/mathematical perspective, what differentiates a hash- and encryption algorithm?
83419
If you hash a string using SHA-256 on your computer, and I hash the same string using SHA-256 on my computer, will we generate the same value? Does the algorithm depend on a seed (so we'd both need the same seed) or some other such parameter?  edit:  To clarify, by 'string' I meant 'the same byte input', which as the comments and @ispiro's answer point out, may be different for the same character string depending on the encoding.
28212
There are many examples of MD5 collisions (some of them can be found here ). But as far as I know two inputs should have the same length to have the same MD5 (or same hash in general). Is it correct? Is there any proof of that?  Or otherwise examples of inputs of different lengths with the same MD5?
56125
There have been several questions regarding  and .  A "pepper" is sometimes mentioned – an application-specific secret key. The  implies that a adding pepper brings the composition close to a MAC, and that cryptographic MAC function should be used rather than concatenating a pepper together with the salt and password.  My question is: Where applicable, what would be a generally recommendable, sound, well understood way to MAC a user password and a secret key, in the context of password hashing?  I want to MAC the password using a secret key, then feed the output of the MAC to a slow hash function (like bcrypt, scrypt, or PBKDF2).  I want to know what kind of MAC to use. To represent the MAC, I'm using this notation   HMAC-SHA256secretkey(message) and HKDFsalt(password) password is the low-entropy user password key is the high entropy secret key (the "pepper") salt is a per-password random value, optionally reused by the subsequent computationally expensive hash such as bcrypt, PBKDF2, or scrypt    Would any of these constructs be more recommendable? Or is there an even better way? And if so, briefly why?   HMAC-SHA256 key(password) HMAC-SHA256password(key) HKDFpassword(salt)   NB: This question is in relation to the "pepper" section near the end of the accepted answer to . Thus the output of the MAC will be fed to a slow, computationally expensive KDF like bcrypt, PBKDF2, or scrypt.
78871
Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?
44961
For example, RSA relies on a mathematically hard problem, factoring, while ECDSA or similar rely on discrete logarithm problem.  What makes SHA-256 and similar hash functions, of the same family, secure against pre-image and collision attacks? What's the math behind it?
46616
Currently I am . Having never used a library for working with large integers before, this seems slow, on the order of 10 times slower, even for ulong length numbers. Does anyone have any better (preferably free) libraries, or is this level of performance normal?
89444
Assuming I'm a bank which seeks for secure hash functions to use in the process of  signing on digital contents.  I'd like to explain / prove why using each one of the following hash functions might be less secure than using SHA-1 (yes, I know SHA-1 no longer considered secure, but the question does consider it as one, or at least states "do not be less secure than sha-1").   $h_{666}(m) = $ some new hash function with 666 bit long output. $h_{ib}(m)=h_{sha-1}(h_{md5}(m))$ $h_{hm}(m)=h_{md5}(m) \oplus h_{sha-1}(m) \oplus h_{ib}(m) \oplus h_{666}(m)$, while the XORing operation here xors the matching bits between two outputs, padding with 0s the smaller ones.   I would say…   I can tell that using new hash function is a bad idea since no one has yet to research and attack it, aside from the fact that more bits is less efficient. Apart from this explanation, I don't see other reason to disqualify this answer. md5 is broken and collisions can be made quite easy, so two different inputs to this function can collide and have the same input to the sha-1 function, which will result in collision between the final outputs. I have no clue how to disqualify this one. The intuition says 'xoring with bad hash functions is not a good idea', but I can't really justify my answer. I also think the padding doesn't actually affect anything, becuase if SHA-1 result is secure then padding 0s to it won't make it collide with other inputs suddenly.   Am I correct, or did I miss something obvious somewhere?  Edit  This is different from  since here the idea is to combine unsecure hash with a secure one. This is not about just combining hashes.
4452
I am very new to cryptography (so be kind), but I have a question that may seem silly.   If the one-time pad is the perfect cipher and impossible to crack, why would the following algorithm not be one of the strongest:  To encrypt:   generate a random bit array using a pseudo number generator with the key as the seed  The generated bit array is the size of the data use a simple XOR to encrypt using the generated bit array   To decrypt:   pseudo-random number generator will generate the same bit array with the same seed (the key) generate bit array the same size of the encrypted data run XOR on encrypted data using bit array that's generated   This is very simplified, but you can imagine how for larger encryption you could break down the data into blocks, and in order to ensure that the block bit arrays are random a new seed for each can be derived from the key. So, if $f(k)$ is the pseudo random number generator, and b is the block number, you can encrypt each block with $f(k+b)$. ($k$ is key)   Instead of using a pseudo-random number generator, you could use some hash algorithm to generate the pad.    (assuming you can use equivalently strong keys) would this not be a very strong cipher method? Perhaps it may be strong and heavy on memory since the pad needs to be the size of the data. So during encryption and decryption you need to generate a pad that's equivalent to the size of the data.   Is there a flaw in this algorithm, or would something like this not be practical and much slower than current standards?
41822
I need to generate a 256 bit encryption key described by the adjectives in the title. Currently I intend to create the key using this .  Is this a secure manner of creating the key, given that it has the following properties:   Private key for symmetric encryption Used many times (of course with unique IV's)   And given the following facts:   I will literally just get the RNG to produce 32 random bytes not doing anything with (1) SALT (2) Iterations (3) Anything else   Please note that I am only asking if the key, directly after being generated, is secure. Thanks
63823
I was recently reading that MD5 is "broken" because it's pretty easy to generate collisions (like 2^(L/2)). And the SHA1 (theoretically) fares no better. The solution seems to be hash algorithms that are very slow in comparison.   I am wondering why can't people combine these fast algorithms to get the best of both security and speed? What would be the time complexity to generate a simultaneous MD5 and SHA1 collision? And if it's hard enough, would these make a viable candidate for collision resistant hash applications?  (By simultaneous collision I mean generating a string with same MD5 and SHA1)
40504
If you want a cryptographically strong random numbers in Java, you use SecureRandom. Unfortunately, SecureRandom can be very slow. If it uses /dev/random on Linux, it can block waiting for sufficient entropy to build up. How do you avoid the performance penalty?  Has anyone used  as a solution to this problem?  Can anybody confirm that this performance problem has been solved in JDK 6?
4208
I was just looking at some , specifically at Hash_DRBG. I read briefly through the algorithm, and even though it is not overly complex, it still seems unnecessary to me. I asked myself how I would implement a (cryptographically secure) PRNG on top of a Hash algorithm (SHA256 or SHA512), what came up is:  Idea one:    Obviously this can only provide half the "strength" of the hash  Initialization: state = hash(seed); Iteration: output = first_half_of(state); state = hash(state); Reseeding: state = hash(state || new_seed)   Idea Two:  Maybe with a separate counter  Initialization: state = hash(seed); Iteration: output = hash(state); ++state; Reseeding: state = hash(state || new_seed)   Now, these two "schemes" seem safe to me, I'm a complete crypto noob though. The point is that I don't think that I'm the first one to think of these very basic PRNGs, and I'd like to understand the reason for NIST not to choose something similar in their recommendations. Do these PRNGs have some (obvious?) weaknesses? (If not, is there something known about after how many iterations they should be reseeded?)
90863
There are many cases in maths where doing the same thing over and over again will bring you closer to a value. Derivation of polynomials is the striking example: no matter what you start with, you end up with 0. In a series expansion, the longer you continue the sequence the closer you get to the real value.  This concept applies in areas other than math (Wikipedia's everything-leads-to-philosophy phenomenon, for example). It's a little unrelated but it just proves the concept.  Hashing algorithms are just special math. Following logically, hash entropy supposedly decreases the more you hash a value. So is there a point at which any input value will give the same hash as any other?  (Let me just specify that we're not re-injecting any new data every time we hash, as if we're trying to increase the security of the hash by salting and re-hashing. It's strictly a matter of md5(md5(md5(... if that's the algorithm we're using.  I can see some problems with this already. Algorithms like md5 are designed to change their output radically when the input changes only by one bit of information. So even if a common hash for two values appears along the way, it itself will start changing. But then, does the fact that the output appears to be very different actually mean the possibilities are still many?