New answers tagged

1

I have used osslsigncode (a linux tool) to dual sign the exe installer with SHA1 and SHA256. For Windows users I have read about a Windows fork of osslsigncode. My current comodo signing certificate 2016 comes with dual digest SHA1 and SHA256 so I only need a single certificate for both signatures. First must go the XP compatible signature: osslsigncode ...


1

Yes, your scenario is acceptable when CA itself has SHA1 certificate, while signing issued certificates with SHA2. Refernces: Internet PKI: CA Browser Forum (CAB Forum) baseline requirements, ยง6.1.5 Microsoft: Windows Enforcement of Authenticode Code Signing and Timestamping Google: An update on SHA-1 certificates in Chrome All these references from ...


0

I'm sorry that I do not know of a modern tool designed to work with deprecated HTTPS servers. Normally Firefox would give you an "Add Exception" button. (hidden behind "Advanced" on the error page) Google Chrome has a "Proceed Anyway" button. However it sounds like you are not getting those options. Many routers offer an HTTP only option to bypass ...


2

As others have explained, 'bits of entropy' refers to to the guess-ability of the original Password or other text that was first used to create the SHA-256 hash. In your example case the entropy is unchanged. What you've done here is provide an SHA-1 version and an MD5 version of the SHA-256. This makes the SHA-256 more guessable than other solutions you ...


19

And it is longer than the input string, with 288bit instead of 256bit. So did we actually increased the entropy? No, you did not increase the entropy. In this context, "entropy" basically refers to the probability of any particular guess about the content or value being correct. If I tell you that I have hashed a single lowercase US English letter's ...


2

You are certainly not adding entropy. You still only will have at most 256bit entropy possible outputs of this schema, no matter how many times and how you rehash this. Note that you will have at most 256 bit entropy, because you did not told us about how much entropy is in your input. SHa256 will also not give you 256bit entropy if you have less than that ...


0

did you increase the entropy... most likely not. All you did is use 2 older hashing functions to get a new hash. since this has no new data, entropy is not affected. The amount of bits here makes no differences whatsoever (since its just 'another way o writing' the original hash.) Entropy (in cryptography) has to do with the amount of uncertainty a ...


2

SHA-1 is broken. When you use SHA-1 to verify the signature of your license files then an attacker can generate a license file which will pass your verification algorithm in reasonable time. Anything they need to do that (your verification algorithms and any shared secrets) must be a part of your program, otherwise it couldn't do offline verification. But ...


4

Its done by using a "Smart card" tamper resistant storage chip, so the key can only be "used", not "extracted". If any attempt is made to attack the chip to reveal the key, different sensors will react and erase the chip as soon as it is powered up. The sensor is usually one-shot, eg when a specific condition is met, the sensor is permanently tripped, so as ...


1

Would a service be impacted if the system does not have any interaction with browsers? Not by the browser sha-1 deprecation. However, sha-1 is used and being deprecated on many other scenarios. Digital signatures, TLS communications in general (clients may start refusing it soon or already refusing it), authentication systems. It should be abandoned as ...



Top 50 recent answers are included