Contents
Which hashing algorithm has no collision attacks?
For the moment, SHA1 is adequate. No collisions are known. It would help a lot to know the average size of the thing you are hashing. But most likely, if your platforms are predominantly 64-bit, SHA512 is your best choice.
What are the two most common salt implementation errors?
The most common salt implementation errors are reusing the same salt in multiple hashes, or using a salt that is too short. A common mistake is to use the same salt in each hash. Either the salt is hard-coded into the program, or is generated randomly once.
How is a salt used in password hashing?
A salt is a random string that is used along with the password in the hash. The salt is typically stored with the hash, so we can assume the attacker also knows the salt. Even though it is not secret anymore, it makes sure that the attacker starts his computations from the moment the hashes (and the salts) are leaked, and not before.
How is iterative hashing used to hash passwords?
Iterative hashing. There are a couple of methods to make a slow hash function, but this blog post is about iterative hashing. The idea is simple: instead of taking just one SHA1 of the password, you take the SHA1 of the SHA1 of the SHA1 of the password. You repeatedly call SHA1 on the previous result.
How many passwords can be hashed in a second?
If you use SHA1 to hash a password, an attacker can try 10,000,000,000 passwords per second on commodity hardware. If you use PBKDF2 with many iterations, an attacker can try 10 passwords per second. That makes a big difference when brute-forcing a password.
Why do you need a hash of a password?
That is why you don’t store a plaintext password, but a hash of the password. This hash can be used to verify whether the user has entered the correct password, but it is not simply reversible to acquire the original password. If someone has the password hash, he can try to brute-force it to acquire the original password.