Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
1answer
46 views

Does john the ripper need to be given the hash format in order to crack it?

Doing some hash rooms on THM and whenever I run the hash files they give me ill just start like this. john --wordlist=rockyou.txt hashfile It will run and then output with a bunch of warnings telling ...
1
vote
1answer
77 views

Security implications of using a non-hash in the password column

Imagine a webapp that uses a traditional email-password-login, with the users-table saving the password salted and hashed using bcrypt. Now a secondary login method should be implemented, like an API ...
-1
votes
1answer
67 views

What are the different ways of finding collisions in SHA? [closed]

I have been researching SHA and its applications. While many SHA algorithms exist they can be categorized into three groups SHA, SHA-1, SHA-2, and SHA-3. SHA through SHA-2 is based on the Merkle–...
0
votes
0answers
13 views

Significant differences in hash cracking speeds? [duplicate]

I'm doing an educational hash research. I generated MD5 hash using online tools and cracked it within a second using Hashcat and certain wordlist (yes, one second). Then I produced a WPA handshake ...
0
votes
0answers
29 views

Data identifier hash function [closed]

I have a case where I need to identify input data. Input data can be in JSON, XML, HTML, or text. In case of JSON or XML, the order doesn't matter, what matter is the structure, keys name, and values ...
0
votes
1answer
94 views

If a file is digitally signed, is posting a hash very useful for security purposes?

In this question I asked about how to handle situations when SHA-256 hashes are not available for a file downloaded from the internet that contains executable code. Another community member ...
0
votes
1answer
45 views

Making already hashed wordlists of all possible combinations [duplicate]

Let us imagine a situation where a company stores its user passwords (let's ignore salts, etc for now) using some hash (say sha256) and the company gets breached. All of the username and password ...
1
vote
0answers
57 views

When file hash not available, how to best check authenticity of a file?

Normally, The Document Foundation (TDF) publishes the SHA-256 and SHA-1 hashes, along with the MD5 checksum, for all LibreOffice releases. For example, see this. However, for their current release (...
2
votes
0answers
49 views

Pros and Cons of hashing password on DB or on API server interacting with db [closed]

I'm trying to understand what is good/bad about hashing a password on a database (like postgres) as opposed to hashing it on an api server and then sending it hashed to the db. Can anyone speak on ...
0
votes
2answers
134 views

How likely is a SHA256 hash to be brute forced on this conditions?

If a string has a length of 16 characters, but it is also known that the first 2 characters are fixed, and that the rest of the string has random letters but letters only, no digits nor special chars, ...
10
votes
4answers
2k views

Password management of emailed cleartext passwords

If a website emails a password in cleartext when you use the "forgot password" function, is there any possibility that the password is hashed? It does generate a different password if you ...
1
vote
0answers
58 views

C++ Decrypt chrome cookies [migrated]

I need to read Chrome cookies in C++, but Chrome encrypts them all. All the other methods of decrypting the cookies I have found are now no longer working, anyone know the latest way to do this?
0
votes
2answers
94 views

Could blockchain be useful for a protocol to verify content from a trusted publisher in the way I'm thinking of? [closed]

The problem with static software whitelisting is that in the real world, employees with versatile jobs need to run unexpected programs. Company sets up a whitelist to limit what programs can run - ...
26
votes
3answers
7k views

Known strings to have the same MD5 hash, not colliding in real life?

I was reading this article about MD5 hash collisions in which it clearly states that these two strings (differences marked with ^): ...
22
votes
4answers
8k views

Does password length / complexity make any difference if hashes are leaked?

Password length/complexity only mitigates a brute force attack, correct? In the event of a hash leak, since any algorithm is a fixed length, there could potentially be a pre-image* with a very short / ...
1
vote
0answers
115 views

Using John the Ripper for Blockchain.info second password

Is there a way to use JtR for Blockchain.info's (v2) secondary password? I already tried the blockchain2john.py file, and it does not ask for primary password (which I know already) so it is going to ...
-3
votes
2answers
126 views

Number of biometric samples required to form an exhaustive set of fingerprint hashes?

Number of biometric samples required to form an exhaustive set of fingerprint hashes? Slight variations in the sample produce different hash values of the sample data. The answer linked below ...
0
votes
2answers
132 views

Odds of two messages sharing the same hash prefix

If only the first h bits of a certain SHA256 hash H of a certain message M are known, and one had managed to successfully guess an input message M' whereby SHA256( M' ) yielded an H' whose first h ...
0
votes
2answers
68 views

Does using subkeys provide better protection in this instance?

I was thinking of implementing the following scheme for encryption of many independent files: From the password, which is given by the user, generate a master key using for example HMAC-SHA. From ...
0
votes
0answers
67 views

Web authentication, replay, nonce and KEK

I am trying to figure out how to build a secure, playback-proof, web authentication scheme and at the same time be able to use a KEK at the server. After a lot of reading it seems that a reasonable ...
0
votes
1answer
70 views

Securing data stored on a file

Suppose I have an application, which when opened asks you to open a file and then "unlock" that file using a password that's configurable by the user. The file should be encrypted with ...
0
votes
2answers
121 views

Is it possible to reverse a hashed password? [duplicate]

Is it possible to reverse a password hashed with bcrypt?
11
votes
5answers
6k views

Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?

I was reading this article which talks about a design to shorten URLs, and in the design section, it says that the given URL can be hashed using a hashing algorithm such as MD5, and then be encoded ...
2
votes
1answer
71 views

How can I use a unique salt for each user

I know there are various questions that seem similar, for instance, this one. However, it does not answer my question. I'm creating a signup/login system (with node.js to be particular), and I'm ...
17
votes
1answer
5k views

How can Freeradius detect if the password provided is right when only the salted hash is stored in the database without the salt

I am discovering both Freeradius and the password hashing mechanism. I built a database (in MySQL) to store the passwords of some users. I have a user with the password in clear text, another one ...
0
votes
0answers
36 views

Display a token's expiration date to a user

We use multiple kinds of token in our system for : Invitation to joint a group Account creation (validate if the user possesses the email address) Validate email address The tokens are sent in a ...
0
votes
0answers
50 views

FedRamp Moderate question about hashing MD5

If I use MD5 but not for cryptography purposes, and not for any authentication or authorization mechanism, Am I in violation of FedRamp Moderate? BR
0
votes
2answers
127 views

Avoiding password cracking by using custom hashing procedure?

In summary: the idea behind password cracking is just to replicate the password validation procedure of a web server locally with lots and lots of attempts and check whether the output of that ...
2
votes
1answer
256 views

How good/bad is this implementation to secure password?

I've just started new project and decide to try something new, so I'am not using anymore EnityFramework and Identity framework. I Decide to try MongoDB, so i wanted to design from scratch storing ...
1
vote
1answer
77 views

Randomness of hash of (password + suffix)

Suppose I have a password, say "thisIsThePassword". Then I have MD5 hashes of that password followed by an increasing numeric suffix: MD5("thisIsThePassword1") = ...
1
vote
1answer
62 views

Is combining salt from two places secure enough and what length

I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough - The password is hashed using PBKDF2-SHA256 (which ...
0
votes
0answers
26 views

Can I truncate a hash value and keep (the expected amount) of collision resistance? [duplicate]

I'm building a URL-shortening tool. For an arbitrary link, I need to produce a fixed-length slug which will index the full URL in a database. For prettiness reasons, I'd like to keep the slug ...
5
votes
2answers
333 views

Since GPUs have gigabytes of memory, does Argon2id need to use gigabytes of memory as well in order to effectively thwart GPU cracking?

The common advice of benchmarking a password hashing algorithm and choosing the slowest acceptable cost factor doesn't work for algorithms with more than one parameter: adding a lot of iterations at ...
0
votes
0answers
73 views

Why Serrcom's H300s authentication mechanism for the router's web panel hashes the password at client side instead of sending it as is?

Whilst I was reverse engineering what calls are performed for Sercomm H300s web panel I found out that the javascript offered for web panel performs an awkward way for username and password ...
0
votes
3answers
70 views

How many bytes for password reset token? Should one take steps to hash or conceal raw CSPRNG bytes?

I'm trying to follow the OWASP 'Forgot Password Cheat Sheet' recommendations for password reset functionality via email. This requires my server to generate a token. OWASP says that PHP's random_bytes(...
0
votes
1answer
91 views

Replace hashed password by public key generated from password

I don't like my server having access to plaintext passwords. Instead of SRP, OPAQUE or another PAKE that needs several rounds, I was thinking I could take the username, server url and password, run a ...
-4
votes
2answers
80 views

Is there a way to programatically generate new hash functions that are secure?

Is it possible to programmatically generate different hash functions? Of course, it is. We can simply tweak the numerical parameters of the hash function. But is there a known way to generate secure ...
0
votes
0answers
63 views

error john the ripper on id_rsa conversion

Why doesn't my conversion from id_rsa work? I have an empty file in the final conversion idrsa.hash and when I use command cat idrsa.hash to check the result is ERRNO2 no such file or directory : ...
0
votes
0answers
64 views

Is salt even secure once hacker has access to the database? [duplicate]

I have seen so many articles which they write that the salt is stored together with the hashed password in the database. However, there's one thing that is bugging me. Since the plain text salt is ...
1
vote
1answer
61 views

How NTLM SSO is preformed on smartcard Kerberos logon?

I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved. After an interactive logon with kerberos, you will have in the cached credentials both ...
3
votes
1answer
385 views

How does Linux know if a new password is a “wrapped” version of a old one?

How does Linux know if a new password is a "wrapped" version of an old password? (or, the process of creating a new password) know "certain" parts of one's password? Let's say I ...
23
votes
6answers
11k views

Is it safe to publish the hash of my passwords?

How unsafe would be to publish the hash of my passwords? I have written a Python script for helping me to remember my basic passwords (computer password, encrypted backup password, AppleID password, ...
5
votes
4answers
2k views

Having a list of hashes for the same password compromise the security of the password?

An attacker want's access to a specific account, he doesn't know the password. It's a high entropy password. +128bits The attacker has the hash for the password (Assuming OWASP suggested bcrypt with ...
1
vote
1answer
216 views

Are bcrypt hashes safe enough if exposed?

Considering: A VERY motivated attacker, A large entropy password, as in 256bits¹ hashed in bcrypt (with recommended cost factor of 12), and Attacker knowledge of everything he might need (except the ...
0
votes
2answers
156 views

Is it OK to hash sensitive data, given hashes provide no confidentiality?

Confidentiality is the property of a message whereby no one but the person who knows a secret (let's calle it K) can read the message. Hashes do not provide confidentiality (data is destroyed, you can'...
1
vote
0answers
109 views

Dynamic format used in John the Ripper jumbo way slower than MDXFind

I'm currently doing some research on a pretty huge list of hashes (approx. 2 millions) and thus I'd like to improve my cracking speed. The hash format is 12 rounds of SHA512(password + salt), which ...
27
votes
4answers
4k views

Do you rather trust a widely adopted algorithm or an underdog if they're cryptoanalytically on a level playingfield?

If it comes to the security a hashing or encryption algorithm provides, we never know the full story. There's that part that we (respectively the public research) understand and can reason about, but ...
1
vote
1answer
82 views

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
0
votes
1answer
29 views

How to sign multiple data sets with a single signature, so that it can be validated for single data set without requiring the rest of the data?

Let's say Alice has three secrets: SecretA, SecretB, SecretC Alice shows these three secrets to Bob and gets a single signature from him that signs all three secrets together. Something like Signature ...
0
votes
4answers
145 views

Why can't you use the same password for every site, if they are hashed on the site?

I've often heard people talking about not using the same password on every website. What's the deal if servers store passwords in a SHA hash instead of plain text? The most they can do is spam you ...

1
2 3 4 5
43