盒子论坛 v2.1

Cryptographic Hash Function: An Overview
https://www.jigsawacademy.com/blogs/cyber-security/cryptographic-hash-function/

Many professionals know about MD5 problem with "Colision" of hash for text distinct... then, think about this "big" problem when use it for store your "password" in database!

MD5 was created essentially for trusth a content, to avoid buy "cat" per "habbit". Not for security for passwords or similar.

If you dont trusth me, search on interger about: "Microsoft" and "MD5" certificate fake!!!

https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/md5-signature-hash-deprecation-and-your-infrastructure/ba-p/400237

https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-for-deprecation-of-md5-hashing-algorithm-for-microsoft-root-certificate-program-august-13-2013-273c039b-5105-86ef-ce0e-0a68838842d8

https://msrc-blog.microsoft.com/2008/12/30/information-regarding-md5-collisions-problem/

etc...

https://www.2brightsparks.com/resources/articles/introduction-to-hashing-and-its-uses.html

https://blog.jscrambler.com/hashing-algorithms

Encryption & Hashing: Simple Definitions
https://www.okta.com/identity-101/hashing-vs-encryption/

Encryption & Hashing: Simple Definitions
Tally up all the sensitive information sitting on your server right now. Add in all the data you pass back and forth with customers, clients, and contractors. How do you keep everything safe?

Some people use the terms encryption and hashing simultaneously. While it's true that they're both used to safeguard information, they do so in very different ways.

Consider these basic definitions:

Encryption scrambles data that can be decoded with a key. The intent is to pass the information to another party, and the recipient will use keys to decipher the data.
Hashing also scrambles data, but the intent is to prove its authenticity. Administrators can run a check on hashed data to determine the contents haven't been touched or altered while in storage. No deciphering key exists.
Both methods involve shielding something sensitive from prying eyes. But clearly, they have different goals and core functions.

Common Hashing Algorithms
All hashing algorithms work in a similar manner. Users input sensitive data, and the system churns through and renders that information ineligible. But not all systems are created equal.

Hashing algorithms include:

MD-5. MD5 is simple, quick, and free to use. It's among the most widely used hash algorithms available, but it's also ripe for hacking. Some experts encourage all companies to pick another method to protect data, but they say about a quarter of all major content systems continue to stick with MD5.

Secure Hash Algorithms (SHA). The National Institute of Standards and Technology published the first SHA algorithm in 1993. Each new release is followed by a number, such as SHA-0 and SHA-1. In general, the higher the number, the more secure the algorithm.

Tiger. This algorithm was published in 1995, and it's made for use on 64-bit platforms. It randomizes data in 24 rounds, and it's considered remarkably secure.

Some companies offer further hash strengthening with a technique called salting. Companies that do this:

Add something. This involves adding a string of unique, random characters to the data they must protect.

Hash the whole string. The original data with the salt addition moves through the algorithm.

Store securely. Companies place the salt value on the site, along with the hashed data.

Repeat. Companies can salt data more than once to offer deeper protection.

Salting is most effective, experts say, when companies use a different salt string for each data point. A password salt, for example, won't be as helpful if each password has the same set of random characters attached. As soon as a hacker figures out that code, all passwords are vulnerable.

for that, read a little more about this technology, on order:

ARGON2
https://github.com/P-H-C/phc-winner-argon2

PBKDF2
https://en.m.wikipedia.org/wiki/PBKDF2

Script
https://en.m.wikipedia.org/wiki/Scrypt

Bcrypt
https://en.m.wikipedia.org/wiki/Bcrypt

HashCat
https://hashcat.net/hashcat/

Password Storage Cheat Sheet
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

Password Hashing Competition:
https://www.password-hashing.net

Here's an "addition":
Many hackers have database with all "MD5" hashes to make it easy to compare a stolen password with their database of MD5 Hashes. So, it will be very easy for him to check which are the most common passwords used throughout the internet.

To give you an idea, there are Databases containing many entire dictionaries from various countries, where hackers have already produced all the "MD5 hash" for them.

For example, the English dictionary is widely used to compare all known words of the mentioned language. Of course, many other countries also have their entire dictionaries in "MD5 hash" format.

So, see that with today's supercomputers, including those you can rent in the clouds, they can produce millions of MD5 hashes per second...
----------------------------------------------
The higher the degree, the greater the respect given to the humblest!RAD 11.3

作者：

emailx45 (emailx45)	▲▲▲▲△	-
	普通会员

2021/7/20 23:37:01

1楼：

加密哈希函数：概述
https://www.jigsawacademy.com/blogs/cyber-security/cryptographic-hash-function/

许多专业人士都知道 MD5 问题与文本不同的哈希“冲突”……那么，当使用它在数据库中存储“密码”时，请考虑这个“大”问题！

MD5 主要是为了信任内容而创建的，以避免每个“习惯”购买“猫”。不是为了密码或类似的安全。

如果您不相信我，请在整数上搜索：“Microsoft”和“MD5”证书伪造！！！

https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/md5-signature-hash-deprecation-and-your-infrastructure/ba-p/400237

https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-for-deprecation-of-md5-hashing-algorithm-for-microsoft-root-certificate-program-august-13- 2013-273c039b-5105-86ef-ce0e-0a68838842d8

https://msrc-blog.microsoft.com/2008/12/30/information-regarding-md5-collisions-problem/

等等...

https://www.2brightsparks.com/resources/articles/introduction-to-hashing-and-its-uses.html

https://blog.jscrambler.com/hashing-algorithms

加密和散列：简单定义
https://www.okta.com/identity-101/hashing-vs-encryption/

加密和散列：简单定义
立即统计您服务器上的所有敏感信息。添加您与客户、客户和承包商来回传递的所有数据。你如何保证一切安全？

有些人同时使用加密和散列这两个术语。虽然它们确实都用于保护信息，但它们的保护方式却截然不同。

考虑这些基本定义：

加密对可以用密钥解码的数据进行加扰。目的是将信息传递给另一方，接收者将使用密钥来解密数据。
散列也会打乱数据，但目的是证明其真实性。管理员可以对散列数据进行检查，以确定内容在存储期间未被触及或更改。不存在解密密钥。
这两种方法都涉及保护敏感的东西免受窥探。但很明显，它们有不同的目标和核心功能。

常用哈希算法
所有散列算法都以类似的方式工作。用户输入敏感数据，系统会翻阅并呈现该信息不合格。但并非所有系统都是平等的。

哈希算法包括：

MD-5。 MD5 简单、快速且免费使用。它是可用的最广泛使用的哈希算法之一，但它也适合黑客攻击。一些专家鼓励所有公司选择另一种方法来保护数据，但他们表示，大约四分之一的主要内容系统继续坚持使用 MD5。

安全散列算法 (SHA)。美国国家标准与技术研究院于 1993 年发布了第一个 SHA 算法。每个新版本后面都有一个数字，例如 SHA-0 和 SHA-1。一般来说，数字越大，算法越安全。

老虎。该算法于 1995 年发布，用于 64 位平台。它在 24 轮中随机化数据，并且被认为非常安全。

一些公司通过称为加盐的技术提供进一步的哈希强化。这样做的公司：

添点什么。这涉及向他们必须保护的数据添加一串独特的随机字符。

散列整个字符串。添加盐的原始数据通过算法移动。

安全存放。公司将盐值与散列数据一起放在网站上。

重复。公司可以多次加盐数据以提供更深层次的保护。

专家说，当公司为每个数据点使用不同的盐串时，盐化是最有效的。例如，如果每个密码都附加了相同的随机字符集，那么密码盐就没有那么有用了。一旦黑客找出该代码，所有密码都容易受到攻击。

为此，请按顺序阅读有关此技术的更多信息：

氩气2
https://github.com/P-H-C/phc-winner-argon2

PBKDF2
https://en.m.wikipedia.org/wiki/PBKDF2

脚本
https://en.m.wikipedia.org/wiki/Scrypt

加密
https://en.m.wikipedia.org/wiki/Bcrypt

哈希猫
https://hashcat.net/hashcat/

密码存储备忘单
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

密码哈希竞赛：
https://www.password-hashing.net

这是一个“补充”：
许多黑客拥有包含所有“MD5”哈希的数据库，以便轻松将被盗密码与他们的 MD5 哈希数据库进行比较。因此，他可以很容易地检查哪些是整个互联网最常用的密码。

给你一个想法，有包含来自不同国家的许多完整词典的数据库，黑客已经为他们制作了所有的“MD5哈希”。

例如，英语词典被广泛用于比较所提及语言的所有已知单词。当然，许多其他国家也有“MD5 哈希”格式的完整词典。

所以，看到了
----------------------------------------------
The higher the degree, the greater the respect given to the humblest!RAD 11.3

信息

登陆以后才能回复