Hot answers tagged

56

I suppose you "use sha1sum" in the following context: you distribute some software packages, and you want users to be able to check that what they downloaded is the correct package, down to the last bit. This assumes that you have a way to convey the hash value (computed with SHA-1) in an "unalterable" way (e.g. as part of a Web page which is served over ...


54

Just to cite wikipedia: http://en.wikipedia.org/wiki/SHA-2: The SHA-2 family consists of six hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256. So yes, SHA-2 is a range of hash functions and includes SHA-256.


34

None of the existing answers cover the critical part of this question to my satisfaction: what about the salts? If just the password hash values were posted, other crackers can't possibly know: The actual per-password (supposedly random, per the source) salt value. How the salt is mixed with the password in the code. All they have is the final, ...


21

General-purpose hashes have been obsolete for passwords for over a decade. The issue is that they're fast, and passwords have low entropy, meaning brute-force is very easy with any general-purpose hash. You need to use a function which is deliberately slow, like PBKDF2, bcrypt, or scrypt. Crackstation actually explains this if you read the whole page. On the ...


17

The SHA-2 family consists of multiple closely related hash functions. It is essentially a single algorithm in which a few minor parameters are different among the variants. The initial spec only covered 224, 256, 384 and 512 bit variants. The most significant difference between the variants is that some are 32 bit variants and some are 64 bit variants. In ...


16

Edit: All of the below assumes that the salts are known, because that's the industry-standard use of the word salt (3rd line). Just as an example of how this often looks in the database, have a look at this SHA-256 Unix Crypt output: $5$rounds=80000$wnsT7Yr92oJoP28r$cKhJImk5mfuSKV9b3mumNzlbstFUplKtQXXMo4G6Ep5 .. where wnsT7Yr92oJoP28r is the salt in ...


16

Don't do it. Salts have to be unique, that's their only requirement. But your approach doesn't generate unique salts, but password-dependent ones. A per-db-unique salt helps when its long enough (256 bits), and you also hash in the username, but that still leaves issues. Having only 3 iterations of SHA256 is rather not the way password hashes should be, ...


16

As @cpast says, the main problem of a single SHA-256 is that it is way too fast. An attacker with an off-the-shelf gaming GPU can try passwords at a rate that is counted in billions per second (American billions, but that's still a lot). Another problem is that there is potential for combining things improperly. SHA-256 is a hash function: it takes one ...


15

Many cryptographic algorithms (hash functions, symmetric encryption...) are organized as a sequence of "rounds", which are more or less similar to each other. It was empirically noticed that for a given algorithm structure, usually, more rounds imply more security; precisely, some classes of attacks (e.g. differential and linear cryptanalysis) see their ...


13

No. Litecoin uses an algorithm called scrypt which has variables that determine the amount of CPU/RAM required to compute hash. Litecoin's scrypt parameters are fixed at N = 1024; p = 1; r = 1. (http://cryptocur.com/litecoin/) Users of Scypt for password hashing purposes should have the parameters set much, much higher which will put password cracking out ...


13

Asymmetric Cryptography There are two different parts to creating a TLS session. There is the asymmetric cryptography, portion which is an exchange of public keys between two points. Which is what you saw in your Alice and Bob example. This only allows the exchange of asymmetric keys for asymmetric encryption/decryption. This is the ECDHE portion. The ...


13

To expand on the point that @cthulhu makes in his comment, the correct answer to this is "nether". SHA2 family hashing algorithms are not designed for password storage and unless you have no choice but to use a general purpose hashing algorithm, they should not be used. To quote this answer the main reasons for this are A basic hash function, even if ...


12

Ability to compute a lot of hashes very fast with dedicated hardware is a problem for password hashes, but not a new problem. Before the advent of ASIC specialized in SHA-256, we were already taking FPGA into account (see for instance this research machine, from already five years ago). An ASIC can roughly be clocked at two to three times the frequency of ...


9

I've now found an example of an actual download that was signed using an SHA-1 certificate after 1/1/2016. I downloaded KeePass 2.31 using Edge on Windows 10. Edge tells me that "The signature of this file is corrupt or invalid." If I right-click and select "run anyway", our double-click the file in Windows Explorer, SmartScreen blocks the file: ...


8

Though SHA-256 nominally offers a 256-bit output, no weakness about it is known when the output is truncated to 128 bits, except, of course, weaknesses inherent to the shorter output length; e.g. collision resistance drops from the infeasible 2128 to the possible (but hard) 264. This is not a generic property of hash functions(*), but it is somewhat ...


8

Such hardware may make life more difficult for people who rely on PBKDF2 for password hashing. Password hashing functions are intentionally slow -- slow for the honest server and for the attacker alike. We want it to be as slow as is tolerable for the server which uses it, so that it becomes (hopefully) intolerably slow for the attacker. The defendant's ...


8

From looking at it for two minutes: Using bcrypt is sound. SHA-256 is one of the best known hash functions (because it has been around for more than 10 years, widely deployed, and yet unscathed). Since you generate a new salt for each encrypted file (and that's good !), it would make sense to store it in a file header. That way, you would not have to ...


8

Cracking unsalted hashes is fairly trivial: you just look up hash in a pre-computed table and find your answer. No sense brute-forcing the rest because your rainbow tables already cover your brute-force dictionary. But cracking salted passwords is still simple; slower but still simple. In most brute-force attacks, the attacker goes for breadth not depth. ...


8

sha256 is not designed to hash passwords. To hash passwords, you should prefer to use hash functions created for this usage. You will find all required information below in another question addressing a similar request: Most secure password hash algorithm(s)?. In the above mentioned question, you will learn why general purpose hash functions like sha256 do ...


8

You should use SHA-256 or SHA-512. If you are only signing packages you have created yourself, then technically SHA-1 is still secure for that purpose. The property that is now weakened is "collision resistance" which you are not strictly relying on. However, the security of SHA-1 is only going to get worse with time, so it makes sense to move on now.


7

It stands within reason that they are not lying. As @Jeff noted that access to the salt is essential for fast cracking, but as @Remus Rusanu noted: "if they obtained the hashes then is hard for me to see how could they not obtain the salt as well" since they must be stored in a such a way that they can be associated with each other. I would assume that: at ...


7

As far as I can tell, your scheme is this: Compute scrypt(pass) and store it as the authentication key in your database. Compute sha256(scrypt(pass)) and use that as your data encryption key. The problem with this technique is that an attacker with access to your database can simply compute the SHA256 hash of your scrypt hashes to gain the encryption ...


7

NIST publishes a lot of test vectors. Including for HMAC (near the end of that page). In the file contained in the Zip archive, the vectors for HMAC/SHA-256 ought to be the ones with the parameter "L=32".


7

According to the length of the text it could be one of the following hash formats: DomainCachedCredentials Haval128 MD2 MD4 MD5 NTLM But (because it is a hash, a one way function) you can't decrypt it. You can try to brute force it, but this will possibly take a very long time. All the rainbow tables I know were unable to identify the original ...


7

SHA 512 is not simply two SHA 256 hashes summed together. Ok now that that is out of the way here goes some tests. The SHA512 of the string 0f13f859096d0cf5029711628c18e22792198a60eb0e561225b03a7316e813ce|4379f8c6822d73c6340bc9a5f9b6380fc2e90d685f5a7e5616779638a2571fa3 is ...


6

By construction, bcrypt is its own function, and does not use a hash function like SHA-1 or SHA-256. You may be confusing it with PBKDF2. Your requirement on "entropy" is, at best, severely misguided: As long as your attackers cannot convert the whole mass of the complete friggin' Galaxy into energy to run some humongous computation, 256 bits of entropy ...


5

SHA256 has never been considered a secure algorithm for password hashing. Use bcrypt, pbkdf2 or scrypt instead. See this is amazing answer by @ThomasPornin for more information.


5

The length extension attack that @Tinned_Tuna talks about would have allowed you to generate forged tokens with a "public text" of your own choosing (within some format constraints due to SHA-256 padding, though), but only if the secret had come first in the hash function. By inputting the secret last, this specific weakness is avoided. Another, less ...


5

Basic rules: Code with "admin privileges" can do everything it wishes with your machine. You cannot protect against it. At best, the malicious code will have to wait for the next time you type your password, at which point it will plunder your private key (and all your secrets). The same "admin exploit" will modify your icon overlays so as to hide any ...


5

First of, a hash function has an input: you hash something. GUID (actually UUID) don't have any input. To generate "unique identifiers" with a hash function, you just don't use a hash function; you have to define what you are actually hashing. There are several standard methods for generating UUID; all these methods aim at achieving "uniqueness" of the ...



Only top voted, non community-wiki answers of a minimum length are eligible