Tag Info

New answers tagged

0

Even if you are not doing work for the federal government, the link to the document below is a good reference to how long people should use hash key lengths until future dates for specific tasks like authenticating a signature. For package authentication, I would also include a size which makes it much harder to create a collision (Changed package that ...


2

You should use SHA-256 or SHA-512. If you are only signing packages you have created yourself, then technically SHA-1 is still secure for that purpose. The property that is now weakened is "collision resistance" which you are not strictly relying on. However, the security of SHA-1 is only going to get worse with time, so it makes sense to move on now.


0

Can you still use it?..Yes you can, but sha-1 is vulnerable to collision attacks and has been depreciated by a number of browsers. If the question was should you still use it, then I would say no you shouldn't, you should move to sha-2 and sha256sum type program.


2

I've written simple python3 script to illustrate: from hashlib import sha256 opad = bytes(0x5c for i in range(64)) ipad = bytes(0x36 for i in range(64)) print(sha256(opad + sha256(ipad).digest()).hexdigest()) The output is identical to the string you seen on wiki. I've checked and I can confirm that your results can be obtained if we concatenate opad ...


13

To expand on the point that @cthulhu makes in his comment, the correct answer to this is "nether". SHA2 family hashing algorithms are not designed for password storage and unless you have no choice but to use a general purpose hashing algorithm, they should not be used. To quote this answer the main reasons for this are A basic hash function, even if ...


2

In fact, they are the same hashing algorithm: SHA2, just with two different digest sizes. It is "cheaper" (faster) to generate SHA256 than SHA512. So from the security perspective a potential attacker will need more time to generate all possible SHA512 hashes to brute force a hashed password from your database. Therefore, you can consider SHA512 as more ...



Top 50 recent answers are included