{"id":2065,"date":"2019-02-01T10:02:28","date_gmt":"2019-02-01T10:02:28","guid":{"rendered":"https:\/\/ibex.tech\/resources\/?p=2065"},"modified":"2024-10-24T23:01:42","modified_gmt":"2024-10-24T22:01:42","slug":"hashing-salting-signatures","status":"publish","type":"post","link":"https:\/\/ibex.tech\/resources\/geek-area\/security\/hashing-salting-signatures","title":{"rendered":"Hashing, Salting, Signatures"},"content":{"rendered":"\n<p>Algorithims that produce a hash using a private key and some stored random &#8220;salt&#8221;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Salting<\/h4>\n\n\n\n<p>Improves the security of hashes because pre computed rainbow tables can&#8217;t be used.  However the effectiveness is arguably becoming less over time as new rainbow tables can be computed faster using FPGA&#8217;s and salting.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Storing Passwords<\/h4>\n\n\n\n<p>On systems at any risk of hacking you should be storing a &#8220;Salted Hash&#8221; of a users password, not the actual password.  It should be impossible for you to tell a user what their password actually is from the information you store &#8211; that is what a slated hash does.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">Dealing with mistyped passwords<\/h5>\n\n\n\n<p>Some sites apparently store a few salted hashes of user entered passwords at the time of generating the salted hash, with common miss-typed versions of what was entered.  They then validate the hash of a user entered password in the future against them all.  Quite a nice trick!<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Hash Signatures<\/h4>\n\n\n\n<p>Algorithims (e.g. SHA256) that produce a hash using a private key that can then be verified using a public key.<\/p>\n\n\n\n<p>What to use (updated 2024-10): SHA2\/SHA3\/BLAKE2\/BLAKE3 are all good. Don&#8217;t use sha1\/md5 as they are no longer cryptographically secure or xxhash\/crc32 as they are not intended to be cryptographically secure.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Algorithims that produce a hash using a private key and some stored random &#8220;salt&#8221; Salting Improves the security of hashes because pre computed rainbow tables can&#8217;t be used. However the effectiveness is arguably becoming less over time as new rainbow tables can be computed faster using FPGA&#8217;s and salting. Storing Passwords On systems at any [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[116],"tags":[],"class_list":["post-2065","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/ibex.tech\/resources\/wp-json\/wp\/v2\/posts\/2065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ibex.tech\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ibex.tech\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ibex.tech\/resources\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ibex.tech\/resources\/wp-json\/wp\/v2\/comments?post=2065"}],"version-history":[{"count":3,"href":"https:\/\/ibex.tech\/resources\/wp-json\/wp\/v2\/posts\/2065\/revisions"}],"predecessor-version":[{"id":2858,"href":"https:\/\/ibex.tech\/resources\/wp-json\/wp\/v2\/posts\/2065\/revisions\/2858"}],"wp:attachment":[{"href":"https:\/\/ibex.tech\/resources\/wp-json\/wp\/v2\/media?parent=2065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ibex.tech\/resources\/wp-json\/wp\/v2\/categories?post=2065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ibex.tech\/resources\/wp-json\/wp\/v2\/tags?post=2065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}