A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

1
vote
3answers
295 views

About SHA1 in default Disk Encryption in Linux

Link to the thread: Recommended options for LUKS (cryptsetup) I wonder what's the exact difference between SHA1 and SHA512. I know that SHA512 has a longer key but I've read that it doesn't matter ...
-1
votes
2answers
114 views

Strength of WPA passwords

How long would it take to crack an 8 letter (latin alphabet, lowercase) password of a WPA PSK network? Is it in reach of a single PC running hashCat?
-4
votes
2answers
121 views

How to identify this hash?

I have one hash, I know its value, but not its type. Here is it: 6dfb036bf703d75f9bc8219ba1224d876783fa61 I tried something like php -r "echo sha1('abc');", but it gave me another value, so this ...
4
votes
1answer
295 views

OpenSSL 0.9.6a PRNG algorithm weakness: How to exploit?

I saw an OpenSSL security advisory for Openssl 0.9.6a Recently a cryptographic flaw in OpenSSL's built-in pseudo-random number generator (PRNG) was pointed out to us by Markku-Juhani O. Saarinen , ...
3
votes
1answer
50 views

Help converting string to NTLM

I'm trying to covert a string into a NTLM hash. From what I understand you just have to covert the characters in the string to unicode, format it to little endian and then hash it with the MD4 ...
2
votes
1answer
241 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
-1
votes
1answer
523 views

Why not use md5 auth mechanisms for IMAP over TLS?

I'm using Dovecot for IMAP connections. I've read a lot of tutorials on how to set up Dovecot, and a lot of them said to only allow: auth_mechanisms = plain login Why should I not allow *-md5 ...
3
votes
0answers
128 views

How far should I go in protecting a user's SMBIOS UUID?

My server will be receiving data from several hundreds of computers. As part of keeping track of which computer sent what, I will be fingerprinting the hardware and keeping the results in my database. ...
3
votes
0answers
121 views

Is there any merit to the RFC 3414 (SNMPv3 User Security Model) password-to-key method?

RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at ...
3
votes
0answers
184 views

Login details security using salt and hash, and a login role in postgresql

I am coding up the security for a website in express.js and postgresql database. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but ...
2
votes
0answers
93 views

Any vulnerability in .net implementation for C# object.GetHashCode?

I've already asked this question on SO, but I think that this forum is more appropriate to discuss security issues. My point is that most OO languages has a way to get a unique hash code for an ...
2
votes
0answers
62 views

How exactly does “Apache Shiro's” hashing work when using a Desktop-Client

I was looking at this question How does storing hash passwords work? and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. ...
2
votes
0answers
33 views

The optimal settings of Winrtgen GIU

I'm working with Winrtgen GIU on windows, but I can't fix the right settings to create a rainbow table for a: password length=1-7 Charset=alpha numeric all space What are the ideal values to put in ...
2
votes
0answers
229 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...
2
votes
0answers
131 views

CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
2
votes
0answers
624 views

How do I convert from this weird John/Asleap format to lc (for HashCat)?

I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
1
vote
0answers
104 views

Find salt from md5 hash if password is known

I have a salted MD5 hash and I also know the password. How can I recover the salt using tools like John The Ripper (I have JTR jumbo installed)?
1
vote
0answers
50 views

Create reduction functions in rainbow tables

I have been trying to understand rainbow tables lately and one part is giving me trouble to understand here. Let's say I want to generate a table where the chains are 100 000 hash/plaintext long. I ...
1
vote
0answers
33 views

Using hash of root password to encrypt files/folders (Debian 8 Linux)

I have an application that requires unattended decryption of files/folders. Would it be possible to utilize the hash of the root password to prevent an attack where a malicious user changes the root ...
1
vote
0answers
20 views

How do atom's apm and npm verify package integrity?

Are there built in verification methods to make sure the packages contain the correct code? Do they use a hash of some sort?
1
vote
0answers
52 views

Which is the correct algorithm while checksumming a portion of code?

As part of my research, I came across a technique in a paper which applies checksumming on a portion of code. I want to implement it. Here is the research paper which talks about the checksumming ...
1
vote
0answers
30 views

Change NTLM hash in memory on the lock screen?

Is there a way to change the ntlm hash in memory to bypass Windows login? For example, I have the NTLM hash of a Windows machine and I have physical access. Is possible to write the NTLM hash in ...
1
vote
0answers
40 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
1
vote
0answers
65 views

SHA1 and SHA256 initial digest to start from

Let's say I have: C = A + B where A and B contain strings and the plus sign means concatenation. I already hashed A with SHA1 and SHA256 and got a digests. I forget what the original A string was, but ...
1
vote
0answers
49 views

trapdoor information with hash functions

I have been playing with an idea for the past few days. I have been unable to find information on here or crypto.stackexchange about using trapdoor information in the input to a hash function. ...
1
vote
0answers
63 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
1
vote
0answers
48 views

Key stretching approaches

I've seen that a number of key stretching algorithms and they involved increasing the number of operations needed to compute the key(i.e. the number of rounds within a hash function). But, I wonder if ...
1
vote
0answers
361 views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
1
vote
0answers
299 views

John The Ripper and OpenCL on AMD FirePro

Trying to work with John 1.8.0 Jumbo 1 I noticed that OpenCL won't work for me. I used autoconfig (meaning configure and build with the option to enable OpenMPI) in order to build JTR for my Mac Pro. ...
1
vote
0answers
227 views

PKCS#7 signed data structure in signed PDF document

Is it mandatory to include PKCS#7 data (OID 1.2.840.113549.1.7.1) octet string into the sequence of PKCS#7 signed data? I mean if you want to sign PDF, you are basically adding PKCS#7 container ...
1
vote
0answers
105 views

Breaking it gently

Let's say I've found a fundamental error with mathematics of a security package. For example, let's say I've found something similar to the Pollard’s \rho-1 algorithm that renders some of the RSA keys ...
1
vote
0answers
182 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
1
vote
0answers
92 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
1
vote
0answers
223 views

Persistent login by hashing password hash

It seems that persistent logins are technically the same as storing a password on the client, and therefore should be avoided whenever possible. However, real life users would be unhappy with having ...
0
votes
0answers
37 views

ISO 9564 Approved Encryption Algorithms for PIN, why symmetric block ciphers?

I am currently researching best practices in designing a potential PIN management solution for a financial services application and began looking into ISO 9564 as a source of requirements. One of the ...
0
votes
0answers
47 views

How to extract the hash from SMB

I have a running PC which I need to test against.It is running Windows with SMB enabled. When capturing using Wireshark while connecting with an incorrect password I see packets being sent to / from ...
0
votes
0answers
20 views

Securing FTP Creds in a Java Open Source API

I've written a basic Java API and source code must be released to a small community for the application to function correctly. The Java API helps developers track data for their running scripts and ...
0
votes
0answers
142 views

HMAC Token - Check Logic

I have a situation where I need a token that provides authentication. The common HMAC procedure I found is: Get Some key using login credentials Create Message, append key and other message data (...
0
votes
0answers
51 views

Applocker rules Publisher vs hash

I'm interested in deploying application white-listing for a large scale environment by using the Windows Server built-in AppLocker mechanism. There is no Internet connection to the environment. My ...
0
votes
0answers
39 views

Malicious node in distributed hash table (Tor)

I'm thinking about the DHT in Tor that is used to look up hidden services. Namely, if you were running a node in the Tor DHT system, 1) Could you realise that you were storing the data for a nasty ....
0
votes
0answers
52 views

Generation of the primes p,q and g for DSA using an Hash Function in OpenSSL

We can generate primes p,q and g for DSA in OpenSSL by using command: openssl dsaparam -text -out dsaparam.pem 1024 Is it possible to generate primes p , q and g using an Hash Function in OpenSSL ...
0
votes
0answers
94 views

Hashing Identifiers to Create Pseudonyms

I'm wanting to share datasets between two organisations in a pseudonymised way such that they link together via mutual entities (e.g. people) but so that the entities cannot be identified. E.g.: ...
0
votes
0answers
56 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
0
votes
0answers
920 views

Line Length Exception in hashcat

I'm very new to cracking a password so sorry if I sound stupid. I am trying to get my admin password from my second PC (I lost it). I did find the SAM file with kali linux and with bkhive and samdump ...
0
votes
0answers
116 views

What is the format of PDF hash?

When I use a tool like pdf2john.py from John The Ripper on an encrypted PDF, it gives me an output like: `testing1.pdf:$pdf$2*3*128*-1028*1*16*3ba51ab2b4f9210274ccb07b8da9ec59*32*...
0
votes
0answers
82 views

Understanding the application of hashes, HMACs, and KDFs

I think that I understand the right application cases for the following crypto functions, but I'd like to confirm my understanding and also propagate the safe use of crypto throughout the intertubes. ...
0
votes
0answers
1k views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...