Questions tagged [hash]
A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
2,286
questions
0
votes
1
answer
692
views
Making already hashed wordlists of all possible combinations [duplicate]
Let us imagine a situation where a company stores its user passwords (let's ignore salts, etc for now) using some hash (say sha256) and the company gets breached. All of the username and password ...
- 1
1
vote
0
answers
309
views
When file hash not available, how to best check authenticity of a file?
Normally, The Document Foundation (TDF) publishes the SHA-256 and SHA-1 hashes, along with the MD5 checksum, for all LibreOffice releases. For example, see this.
However, for their current release (...
- 3,144
2
votes
0
answers
189
views
Pros and Cons of hashing password on DB or on API server interacting with db [closed]
I'm trying to understand what is good/bad about hashing a password on a database (like postgres) as opposed to hashing it on an api server and then sending it hashed to the db. Can anyone speak on ...
- 21
0
votes
2
answers
1k
views
How likely is a SHA256 hash to be brute forced on this conditions?
If a string has a length of 16 characters, but it is also known that the first 2 characters are fixed, and that the rest of the string has random letters but letters only, no digits nor special chars, ...
- 11
10
votes
4
answers
3k
views
Password management of emailed cleartext passwords
If a website emails a password in cleartext when you use the "forgot password" function, is there any possibility that the password is hashed? It does generate a different password if you ...
- 103
0
votes
2
answers
183
views
Could blockchain be useful for a protocol to verify content from a trusted publisher in the way I'm thinking of? [closed]
The problem with static software whitelisting is that in the real world, employees with versatile jobs need to run unexpected programs. Company sets up a whitelist to limit what programs can run - ...
- 1,310
26
votes
3
answers
9k
views
Known strings to have the same MD5 hash, not colliding in real life?
I was reading this article about MD5 hash collisions in which it clearly states that these two strings (differences marked with ^):
...
- 485
22
votes
4
answers
9k
views
Does password length / complexity make any difference if hashes are leaked?
Password length/complexity only mitigates a brute force attack, correct? In the event of a hash leak, since any algorithm is a fixed length, there could potentially be a pre-image* with a very short / ...
- 323
1
vote
0
answers
408
views
Using John the Ripper for Blockchain.info second password
Is there a way to use JtR for Blockchain.info's (v2) secondary password?
I already tried the blockchain2john.py file, and it does not ask for primary password (which I know already) so it is going to ...
- 61
-3
votes
2
answers
246
views
Number of biometric samples required to form an exhaustive set of fingerprint hashes?
Number of biometric samples required to form an exhaustive set of fingerprint hashes?
Slight variations in the sample produce different hash values of the sample data. The answer linked below ...
- 93
0
votes
2
answers
610
views
Odds of two messages sharing the same hash prefix
If only the first h bits of a certain SHA256 hash H of a certain message M are known, and one had managed to successfully guess an input message M' whereby SHA256( M' ) yielded an H' whose first h ...
- 111
0
votes
2
answers
157
views
Does using subkeys provide better protection in this instance?
I was thinking of implementing the following scheme for encryption of many independent files:
From the password, which is given by the user, generate a master key using for example HMAC-SHA.
From ...
- 225
1
vote
0
answers
208
views
Web authentication, replay, nonce and KEK
I am trying to figure out how to build a secure, playback-proof, web authentication scheme and at the same time be able to use a KEK at the server.
After a lot of reading it seems that a reasonable ...
0
votes
1
answer
147
views
Securing data stored on a file
Suppose I have an application, which when opened asks you to open a file and then "unlock" that file using a password that's configurable by the user.
The file should be encrypted with ...
- 23
0
votes
2
answers
3k
views
Is it possible to reverse a hashed password? [duplicate]
Is it possible to reverse a password hashed with bcrypt?
- 17
13
votes
5
answers
9k
views
Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?
I was reading this article which talks about a design to shorten URLs, and in the design section, it says that the given URL can be hashed using a hashing algorithm such as MD5, and then be encoded ...
- 233
2
votes
1
answer
622
views
How can I use a unique salt for each user
I know there are various questions that seem similar, for instance, this one. However, it does not answer my question.
I'm creating a signup/login system (with node.js to be particular), and I'm ...
- 23
17
votes
1
answer
7k
views
How can Freeradius detect if the password provided is right when only the salted hash is stored in the database without the salt
I am discovering both Freeradius and the password hashing mechanism. I built a database (in MySQL) to store the passwords of some users. I have a user with the password in clear text, another one ...
- 173
0
votes
0
answers
132
views
Display a token's expiration date to a user
We use multiple kinds of token in our system for :
Invitation to joint a group
Account creation (validate if the user possesses the email address)
Validate email address
The tokens are sent in a ...
0
votes
0
answers
310
views
FedRamp Moderate question about hashing MD5
If I use MD5 but not for cryptography purposes, and not for any authentication or authorization mechanism, Am I in violation of FedRamp Moderate?
- 111
0
votes
2
answers
347
views
Avoiding password cracking by using custom hashing procedure?
In summary: the idea behind password cracking is just to replicate the password validation procedure of a web server locally with lots and lots of attempts and check whether the output of that ...
- 3
1
vote
1
answer
815
views
How good/bad is this implementation to secure password?
I've just started new project and decide to try something new, so I'am not using anymore EnityFramework and Identity framework. I Decide to try MongoDB, so i wanted to design from scratch storing ...
- 113
1
vote
1
answer
434
views
Randomness of hash of (password + suffix)
Suppose I have a password, say "thisIsThePassword".
Then I have MD5 hashes of that password followed by an increasing numeric suffix:
MD5("thisIsThePassword1") = ...
- 15.8k
1
vote
1
answer
197
views
Is combining salt from two places secure enough and what length
I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough -
The password is hashed using PBKDF2-SHA256 (which ...
- 113
0
votes
0
answers
42
views
Can I truncate a hash value and keep (the expected amount) of collision resistance? [duplicate]
I'm building a URL-shortening tool. For an arbitrary link, I need to produce a fixed-length slug which will index the full URL in a database. For prettiness reasons, I'd like to keep the slug ...
9
votes
2
answers
5k
views
Since GPUs have gigabytes of memory, does Argon2id need to use gigabytes of memory as well in order to effectively thwart GPU cracking?
The common advice of benchmarking a password hashing algorithm and choosing the slowest acceptable cost factor doesn't work for algorithms with more than one parameter: adding a lot of iterations at ...
- 32.9k
0
votes
3
answers
655
views
How many bytes for password reset token? Should one take steps to hash or conceal raw CSPRNG bytes?
I'm trying to follow the OWASP 'Forgot Password Cheat Sheet' recommendations for password reset functionality via email. This requires my server to generate a token. OWASP says that PHP's random_bytes(...
- 216
0
votes
1
answer
287
views
Replace hashed password by public key generated from password
I don't like my server having access to plaintext passwords. Instead of SRP, OPAQUE or another PAKE that needs several rounds, I was thinking I could take the username, server url and password, run a ...
- 181
-4
votes
2
answers
167
views
Is there a way to programatically generate new hash functions that are secure?
Is it possible to programmatically generate different hash functions? Of course, it is. We can simply tweak the numerical parameters of the hash function. But is there a known way to generate secure ...
- 101
0
votes
0
answers
466
views
error john the ripper on id_rsa conversion
Why doesn't my conversion from id_rsa work?
I have an empty file in the final conversion idrsa.hash
and when I use command cat idrsa.hash to check the result is
ERRNO2 no such file or directory : ...
- 1
0
votes
0
answers
64
views
Is salt even secure once hacker has access to the database? [duplicate]
I have seen so many articles which they write that the salt is stored together with the hashed password in the database. However, there's one thing that is bugging me. Since the plain text salt is ...
- 9
1
vote
1
answer
627
views
How NTLM SSO is preformed on smartcard Kerberos logon?
I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved.
After an interactive logon with kerberos, you will have in the cached credentials both ...
- 33
3
votes
1
answer
899
views
How does Linux know if a new password is a "wrapped" version of a old one?
How does Linux know if a new password is a "wrapped" version of an old password?
(or, the process of creating a new password) know "certain" parts of one's password?
Let's say I ...
- 177
23
votes
6
answers
14k
views
Is it safe to publish the hash of my passwords?
How unsafe would be to publish the hash of my passwords?
I have written a Python script for helping me to remember my basic passwords (computer password, encrypted backup password, AppleID password, ...
- 349
5
votes
4
answers
3k
views
Having a list of hashes for the same password compromise the security of the password?
An attacker want's access to a specific account, he doesn't know the password.
It's a high entropy password. +128bits
The attacker has the hash for the password (Assuming OWASP suggested bcrypt with ...
- 175
2
votes
1
answer
4k
views
Are bcrypt hashes safe enough if exposed?
Considering:
A VERY motivated attacker,
A large entropy password, as in 256bits¹ hashed in bcrypt (with recommended cost factor of 12), and
Attacker knowledge of everything he might need (except the ...
- 175
1
vote
2
answers
2k
views
Is it OK to hash sensitive data, given hashes provide no confidentiality?
Confidentiality is the property of a message whereby no one but the person who knows a secret (let's calle it K) can read the message.
Hashes do not provide confidentiality (data is destroyed, you can'...
- 113
1
vote
0
answers
1k
views
Dynamic format used in John the Ripper jumbo way slower than MDXFind
I'm currently doing some research on a pretty huge list of hashes (approx. 2 millions) and thus I'd like to improve my cracking speed. The hash format is 12 rounds of SHA512(password + salt), which ...
- 111
27
votes
4
answers
4k
views
Do you rather trust a widely adopted algorithm or an underdog if they're cryptoanalytically on a level playingfield?
If it comes to the security a hashing or encryption algorithm provides, we never know the full story. There's that part that we (respectively the public research) understand and can reason about, but ...
1
vote
1
answer
952
views
Do all files downloaded from the web, come with a checksum to verify the file?
Pretty straightforward question. Take the image here:
https://i.imgur.com/oEdf6Rl.png
Does it come with a checksum, which I can verify against after I have fully downloaded the file?
This question ...
0
votes
1
answer
100
views
How to sign multiple data sets with a single signature, so that it can be validated for single data set without requiring the rest of the data?
Let's say Alice has three secrets: SecretA, SecretB, SecretC
Alice shows these three secrets to Bob and gets a single signature from him that signs all three secrets together. Something like
Signature ...
0
votes
4
answers
259
views
Why can't you use the same password for every site, if they are hashed on the site?
I've often heard people talking about not using the same password on every website. What's the deal if servers store passwords in a SHA hash instead of plain text? The most they can do is spam you ...
2
votes
1
answer
905
views
dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?
I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt.
I want to confirm some of my understandings:
Salt is automatically generated by cyrptsetup with ...
- 153
2
votes
0
answers
282
views
Why does firebase encrypt with password hashes instead of storing the hashes?
I am trying to migrate off of firebase, as in doing so, you can export the hashes of user passwords. Looking at their algorithm, they do not store password hashes, but rather, they use the first 32-...
- 121
0
votes
1
answer
650
views
OpenSSL: how to get matching subject_hash from a CMS SignerInfo?
So OpenSSL can calculate a hash value for X509 certificates that uniquely identifies this certificate:
https://www.openssl.org/docs/man1.0.2/man1/x509.html (argument -hash or -subject_hash)
now, if I ...
1
vote
1
answer
233
views
Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?
To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
- 115
0
votes
1
answer
297
views
Sending and blocking emails from hashed and salted address ? (for GDPR)
I would like to send emails from a server, but also make them unable to trace for me as server owner or attackers. I want this for GDPR but also to protect people from abusers.
Short info about ...
user250107
6
votes
1
answer
8k
views
For bcrypt why is JTR so much faster than hashcat?
To keep it short I've recently been learning about hashing and password hash cracking on TryHackMe.
I was tasked to crack the following hash: $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V....
- 61
1
vote
1
answer
501
views
Config file contains password hashes and signature keys
First, I am a beginner in IT security. I hope my question is not too dumb.
I use a program that can show a live feed from a security camera. You can import a project file, that sets up user accounts ...
- 111
4
votes
2
answers
824
views
Why should I go to SHA512withRSA signature for my Android apps?
I have an Android 11 device and many of my apps and system apps use MD5withRSA or SHA1withRSA as signature algorithm by default.
Why should I take my apps SHA256withRSA or SHA512withRSA? Are there any ...
- 41