Questions tagged [sha256]
SHA-256 is a hashing algorithm.
192
questions
2
votes
3
answers
1k
views
OpenSSL: best way to get sha256 hash of two sha256 hashes
I have two sha256 hashes as hex strings
HASH1=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
HASH2=7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730
now I want to ...
0
votes
1
answer
713
views
Collision probability between truncating vs subsequencing of SHA256 hash to 128 bits?
I am taking a SHA256 hash output in hexadecimal (64 hex nibbles), subsequencing it by taking every other character to make it 32 hex nibbles or 128 bits, and formatting it into a UUID string.
This isn'...
0
votes
1
answer
4k
views
Reverse engineering server seed
$server_seed = "2754f7cc9e9e243711448401ea9d483067138a6b37c70c5d80b6c59943aa6996";
$lotto = "1135567382";
$round_id = "1";
$hash = hash("sha256", $server_seed . "-" . $lotto . "-" . $round_id);
$...
9
votes
2
answers
96k
views
Is using "SHA-256 with RSA-2048 Encryption" a secure certificate hashing algorithm?
Is using "SHA-256 with RSA-2048 Encryption" a secure certificate hashing algorithm? I don't think it is. Two examples: nsa.gov [careers site] give.wfp.org
0
votes
1
answer
216
views
JWT - Able to change signature and its still verified?
I just ran into something strange IMO.
I created a RSA Key using nodejs cryptoutils to use with my JWT auth server.
What I observer using jwt.io was the following:
The last letter of the signature can ...
1
vote
2
answers
181
views
Does a database with pre-calculated SHA256 values exist for Windows EXEs?
Background: At my place of work, we're trying to block all unapproved browsers on all Windows machines and the IT Security guys did a search on our internal infrastructure and came up with a list of ...
0
votes
1
answer
96
views
Implications of SHA256 implementation producing false / unexpected hashes
I found that one of our programs uses an sha256 implementation, that produces different hashes for same inputs, compared to standard libraries (in this case compared to node:crypto and Web Crypto API.
...
-2
votes
1
answer
261
views
Is it possible to bruteforce SHA256? [duplicate]
SHA256, 64 characters using only 0-9 or lowercase a-f
Making 1.15792089E+77 total possible combinations. Is it possible to crack the input for its given hash?
0
votes
1
answer
462
views
Generating a SHA-256 hash from the Linux command line
I know the string "03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd" generates the SHA-256 hash 4c0b2d2f119a09b607cb273a745b2b0430d5192e0c4e536f932be5d1a6be5883 using https:...
15
votes
6
answers
8k
views
Is it possible to generate a file with a given sha256sum checksum?
Is it possible to generate a file with a given sha256sum checksum?
That is, reverse the process of a sha256sum checksum. That is, if we have a checksum, can we generate txt file data (need not be ...
23
votes
2
answers
41k
views
Client-server encryption technique explanation (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 128 bit keys)
I opened a web page using HTTPS.
When I looked at the page info provided by my Web browser (Firefox) I saw the following:
Connection encrypted: High-grade Encryption
(...
1
vote
0
answers
115
views
The hash of kali-linux-2022.4-raspberry-pi-arm64.img.xz changed after burning it into an sd card
I was burning an iso file into the sd card with pi imager and I doubled checked the hash before the burning and after and I got different results
sha256sum kali-linux-2022.4-raspberry-pi-arm64.img.xz
...
3
votes
1
answer
2k
views
BLAKE-3 vs SHA-256 security
As we can see on this page, BLAKE-3 is about 14 times faster than SHA-256. Is it as safe as SHA-256? I would like to use it for my passwords which are 32 cryptographically random bytes, because my API ...
3
votes
1
answer
6k
views
Is it possible to reverse a sha256 hashed value if we know part of the input value?
I'm a total noob, so please help me out.
Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text?
Ex: xxxxxx + j4l58jl6j4l6j4 = ...
0
votes
1
answer
455
views
Generating AES 256 key from ECDH P-384
Is there anything wrong with hashing(with SHA256) the shared secret generated by ECDH that is 384 bits long and using that as the AES key? Is there a difference between that and, say, truncating the ...
6
votes
5
answers
3k
views
Are SHA-256 hashes of user emails guaranteed to be unique?
I'm working on a website that will require users to insert a valid email address, which will work as their unique user id. This email will not be used for communicating with the user, it is only ever ...
4
votes
1
answer
1k
views
What is the math behind iterations in PBKDF2-SHA256 for lastpass users?
I am looking for a technical estimate of how bad the situation is regarding the recent hack of lastpass. The hack was covered by several outlets: Naked Security, Ars Technica.
Lastpass has admitted ...
7
votes
2
answers
8k
views
Is PBKDF2 only SHA1 in C#?
I can't find a way of specifying the hashing algorithm used by the PBKDF2 (the Rfc2898DeriveBytes class) implementation in C# System.Security.Cryptography.
It seems to be just SHA1. Am I missing ...
0
votes
2
answers
274
views
What should we expect of the SHA256 of a file's webpage vs. the one we get once we download the file?
I want to know whether the SHA256 of a file changes from being available for download to once we downloaded to a device.
For example, I got the URL https://dl.google.com/tag/s/appguid%3D%7B8A69D345-...
1
vote
1
answer
104
views
Microsoft Teams encryption verification
This link suggests that MS Teams calls are encrypted and can be verified by reading out the 20-digit security codes found on the endpoint computers.
To protect against a man-in-the-middle attack ...
59
votes
5
answers
18k
views
Is it secure to use MD5 to verify the integrity of small files (less than 15kb)?
I know that collision for MD5 has been documented since the 90s and that digital certificates based off of MD5 has been demonstrated to be completely compromised back in 2010 but how effective is MD5 ...
1
vote
3
answers
348
views
SHA256 for hashing 32 cryptographicaly random bytes
I need to hash 32 cryptographically random bytes, but later the verification the value with hash must be very fast, so I decided to use SHA256. Is it a security issue if my passwords are 32 ...
2
votes
3
answers
7k
views
How can I extract salt from encoded base64 Salted SHA 256 hashed password
I have a SSHA256 hashed password. Below is the plaintext and hashed password for it.
PlainText -p@ssw0rd
Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
5
votes
2
answers
5k
views
How to reasonably hash a composite key into a UUID?
The Problem
In our system users are identified by a composite key. We'd like to devise a scheme to deterministically convert this composite key into a UUID.
Solutions?
The obvious first suggestion ...
25
votes
6
answers
9k
views
Is a sha256 hash of a unix timestamp a strong password
I am setting up a postgres db that will never be used by humans. In fact, I really don't need to know it myself ever. I assumed that just using a 256bit(64 alphanumeric chars) hash of a unix timestamp ...
10
votes
4
answers
7k
views
SHA & MD5 Collisions for shorter strings
This is not for passwords. I understand that MD5 and SHA-512, etc... are insecure because they can have collisions.
However, is it still possible to have a collision if the string length is less than ...
0
votes
1
answer
801
views
Why REST APIs that do not use RSA encryption to secure API keys?
After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key.
The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
2
votes
2
answers
3k
views
Is there a relationship between the size of RSA key and size of hash function?
I have seen that for RSA2K the hash function SHA-256 has been used.
Now my question is if I want to use RSA3K, should I change the size of the hash function for example from SHA-256 to SHA-384? Is ...
13
votes
7
answers
17k
views
How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?
Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives.
I wonder how much safer is the use of the SHA256 hashes for integrity checks?
Note: Consider ...
10
votes
1
answer
4k
views
Does 7-Zip really run multiple rounds of SHA-256 when key stretching?
Recently I was testing whether I could make 7-Zip archives more bruteforce-resistant. Both someone on Wikipedia and @kelalaka on this website make the following claim:
The 7z format supports ...
2
votes
3
answers
1k
views
Can a SHA2 x509 cert thumbprint be spoofed/specified?
Looking at a potential solution where the thumbprint of a client cert is used to identify individual users and provide access control.
Supposing someone was able to view the thumbprint of a cert ...
11
votes
2
answers
15k
views
Why is SHA-256 not good for passwords? [duplicate]
I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 ...
73
votes
4
answers
102k
views
What are requirements for HMAC secret key?
I'm creating HTTP REST service which will be available over tls only.
For authentication purposes I plan to generate JWT token for every user using HMAC HS256. I need a secret key for HMAC.
What are ...
0
votes
0
answers
16
views
Identify hash pattern inside a string [duplicate]
I believe that this question was answered already, though I couldn't find it.
I have several strings that include hash. Each string has hash and some random (or not) add-on.
How can I identify the ...
0
votes
2
answers
1k
views
How likely is a SHA256 hash to be brute forced on this conditions?
If a string has a length of 16 characters, but it is also known that the first 2 characters are fixed, and that the rest of the string has random letters but letters only, no digits nor special chars, ...
0
votes
1
answer
273
views
How many bits of security does a hash as a verifier provide?
Let's say I have a binary string s, that is generated by a cryptographically secure random byte generator, and a hash function SHA-256.
I am using the hash h=sha256(s) as a one-time password verifier ...
7
votes
3
answers
3k
views
Hashing a large file on an embedded system
I'm trying to come up with a way to verify the authenticity of a file that I'm downloading from a server to an embedded system. I'm thinking of using a hash (SHA256 preferably). My main concern is ...
2
votes
1
answer
1k
views
Is it possible to tell if a file's message digest is MD5 or SHA-256?
There's some old data encrypted with OpenSSL 1.0.2, but now OpenSSL is at 1.1.0. I understand from OpenSSL FAQ USER3 that an old file can be decrypted with 1.1.0 by using -md md5. But let's say you ...
0
votes
2
answers
287
views
Lastpass: Can we use more rounds of SHA-256 for decryption than user authentication?
I'm new to computer security, there's one question I got confused. The book "Security in Computing" describe that "To protect the master password, the client uses a form of PBKDF2, ...
12
votes
4
answers
5k
views
What are the pros and cons of using sha256 to hash a password before passing it to bcrypt?
I recently became aware of the fact that bcrypt truncates passwords to 72 characters. Practically speaking my intuition is that this does not pose any major security problems. However, I understand ...
23
votes
9
answers
30k
views
Deprecation of SHA1 code signing certificates on Windows
EDIT (7/7/2016) - see addition at the end of post
I have been keenly following the issues with regards to Microsoft deprecating the use of SHA1 code-signing certificates for Windows executables (http:...
3
votes
2
answers
262
views
Appropriate length and slow, unsalted cryptographic hash function for random codes?
Given the following situation: we have sensitive information and want to give a user access to it. At this point the user might not have interacted with our system yet.
We generate a random code that ...
1
vote
1
answer
166
views
How to confirm the last entry of a linked hash list
We use a linked hash list for data integrity.
Content is hashed (HMAC-SHA256) and stored in a block that itself is hashed and referenced in the next block:
Simplified example:
...
{
id: "...
0
votes
3
answers
1k
views
Different SHA256 checksum of same version of ssh binary on different machines
I was wondering if I compare SHA-256 of two binaries with same version on different machines, results will be two identical checksums.
I tried this on ssh on macOS (Catalina). (I checked that ssh -V ...
0
votes
2
answers
570
views
File SHA256 checksum failed, but OK on reboot
I downloaded the Windows installer (.exe) for ImageMagick via http (both http and ftp downloads are provided here).
Upon executing the file, Windows SmartScreen displays a banner across the screen ...
0
votes
1
answer
717
views
Challenge-Response authentication and SSL
I'm currently developing an Android Application that communicates with a server and needs the user to login.
The connection is secured with SSL and certificate pinning.
For user authentication I'm ...
0
votes
1
answer
180
views
How are these transaction fingerprints colored?
For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
0
votes
0
answers
518
views
AES_GCM ciphers are not disabling using SHA256 or SHA384
I am trying to disable ciphers using jdk.tls.disabledAlgorithms.
I have created a properties file named disabledAlgorithms.properties and it is has jdk.tls.disabledAlgorithms=AES_128_CBC,SHA1,SHA256.
...
0
votes
1
answer
442
views
Modifying a SHA256 system to be ASIC resistant
I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant.
...
23
votes
1
answer
59k
views
John the ripper does not crack password
I'd like to attack a self-created sha256 hash with john --wordlist=
So far I've done the following:
$ echo 'testpassword' | sha256sum > mypassword
removed the tail of the output with vim
$ cat ...