Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
2
votes
3answers
103 views

What is the best way to store the verifyer for posession of a high entropy secret?

This is just a thought experiment. I am trying to get an understanding on when we need password hashing functions and when they don't bring any benefits (eg. to save on calculation cost). I know that ...
0
votes
0answers
51 views

Does this hash have a name? [closed]

I know this hash is not secure, but does this have a name? Here's the flow Create a character array with "Hello, World!" Create an empty integer with 0 For each character in the array, ...
0
votes
1answer
31 views

How does TLS use hashing from the negotiated cipher suite

I am trying to understand why TLS only uses hashing algorithm like SHA-384 instead of using an HMAC instance like HMAC-SHA-384. If I understand correctly, this cipher suite (...
0
votes
0answers
4 views

What precaution to take when opening malware file using python script [migrated]

I'm writing a Python script to check the file hash of a malware sample against the VirusTotal database. At the moment, I'm using a build in open and read functions provided in a standard python ...
0
votes
1answer
67 views

UUIDs replacing inremental IDs in URLs

I am reading about implementing UUIDs in URLs instead of incremental IDs to reduce attack vectors using obfuscation. I plan to create a UUID from an incremental ID and store the UUID which would be ...
0
votes
1answer
63 views

Get hash algorithm knowing hash, salt and password [duplicate]

I have multiple salted hashes and I know the passwords, but I want to know the algorithm used to make the hash. For example, hash dcdc884c4ead4f713e9d15c1e14f5b07dfe184ea salt 93295 password xx123123 ...
0
votes
2answers
107 views

John The Ripper does not load password hash, how can I fix it?

I want to crack a specific hash password with JTR: 48bb6e862e54f2a795ffc4e541caed4d I put this hash in a txt file like this: echo '48bb6e862e54f2a795ffc4e541caed4d' > hash.txt and I run JTR in ...
0
votes
0answers
56 views

double hashing for code signing and verification

I have environmental constraints where the cyber and safety functions are segregated such that safety operations are handled by one unit and cyber operations such as firewall, HIDS, secure storage etc....
0
votes
1answer
59 views

What tools currently allow to retrieve Windows 10/11 password hashes, given admin rights or physical access to unencrypted disks?

I was wondering what Windows/Linux/Live tools allow to retrieve user password hashes of modern 2021 Win10/11 installations. I am not sure if password storage differs in these cases (e.g. different ...
29
votes
5answers
8k views

Security of hashing and encryption algorithms for 30 years

Assuming a product shelf life of 30 years and the product which is released now in 2021, what is the recommendation/suggestion for hashing or encryption algorithms to use in the product? That means, ...
0
votes
0answers
66 views

XMPP authentication bruteforce with hashcat

This question is about how efficient it is to bruteforce SASL authentication in the XMPP protocol. I read the XMPP SASL authentication steps (stackoverflow link in case the first one breaks), and ...
1
vote
2answers
203 views

Effective ways to hash phone numbers?

Suppose a company wants to implement 2FA for it's users using phone number OTP system, but does not really want to store their phone numbers as it could get breached and phone numbers are considered ...
0
votes
1answer
69 views

Cracking hashes of trivially modified passwords

If I started with “password”, then change it to “password2”, “password3” etc, is that easier to crack the hashes of the set of passwords than if I used only the original password? Does having the ...
0
votes
0answers
44 views

About password ciphertext [duplicate]

I need to decrypt a password. I have the ciphertext for this however, I have many plain text and encrypted equivalents. This device can only be given passwords with a maximum of 8 characters from the ...
0
votes
1answer
125 views

Is it bad practice to store passwords in iCloud notes?

I was wondering something about a day ago when I remembered that Apple stores notes in a database (so you can recover them or view them on icloud.com) - What if Apple stores your notes in plaintext? I'...
3
votes
1answer
87 views

Does using multiple rounds of hashing increase chances of a collision?

Let's imagine that we have a particularly bad hashing algorithm that, given any input, will output 1 of only 100 possible hashes. Now lets imagine that 2 of these possible hashes, when hashed again, ...
0
votes
1answer
121 views

pwdump8-8.2 correct hash for Microsoft Account Win10

I am having a real issue cracking one NT hash i've pulled from my system for a Microsoft Account. I used - PwDump8.2 I have an admin account unlocked on the system and can access most files. I know ...
0
votes
1answer
86 views

Creating Wordlist from specific characters and numbers using Mentalist or similar program

I have locked myself out of my Win 10 Microsoft account by forgetting my password and need to get back into it. I have extracted the hash for the account. I've been researching wordlists and hash ...
0
votes
0answers
75 views

Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error

So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
0
votes
1answer
128 views

Guidance on Storing Email Addresses as Hashes

I am building an application where one user (User A) can store a "query" of another user (User B) that may or may not exist in the system. This query can be done by email address. The ...
2
votes
1answer
153 views

Creating and Comparing Hashing Windows certutil and external hash libraries

I have a question about checking hashes and what is the best utility for it. Seems like you can use some external programs like md5sum or sha1sum. But can't you just use (on Windows) certutil -...
0
votes
1answer
62 views

X.509 certificate's signature algorithm vs. algorithm used in key derived from it to verify a signature

I have the following from Google's public certs for verifying JWT ID -----BEGIN CERTIFICATE----- MIIDHDCCAgSgAwIBAgIIW4K0b18ff70wDQYJKoZIhvcNAQEFBQAwMTEvMC0GA1UE ...
0
votes
0answers
26 views

Help with identifying patterns or cryptographic implement [duplicate]

While I'm pen testing, I came across these values mapping to a store ID. These values are gathered across three different accounts. 0015400000jpjcEAAQ 0015400000jrjH7AAI 0015400000jtDS9AAM It's not a ...
0
votes
1answer
68 views

How to change the password hashing scheme in LDAP using an external library with slapd.d config

I am trying to change the password hashing scheme for LDAP. Hypothetically, let's assume it's pw-argon.so I don't have slapd.conf I have the slapd.d directory where I can make changes dynamically to ...
0
votes
1answer
135 views

Encryption Algorithm With Separate One-Way (Hashing) And Two-Way (Decryption) Keys

In cryptography, generally we have two ways of handling sensitive information. We can use one-way encryption such as hashing. This is useful when we never need to retrieve it again. In this case, we ...
1
vote
2answers
191 views

How many rounds of Bcrypt to use for security equivalent to SHA256?

We regularly use 10000 iterations of SHA256 for hashing passwords. If we want to have similar security, how many rounds/work factor should we use when hashing passwords with bcrypt?
1
vote
2answers
128 views

Irreversible encryption - difference to hash?

I keep reading the term "reversibly encrypted" and that confuses me because I thought that is kind of the point of encryption, that it can be decrypted. I googled it, as a good student, and ...
0
votes
0answers
14 views

GRZXW5EDY - Does anyone recognize what kind of hash/id is this? [duplicate]

I am black-box testing a video streaming website. They have 2 kind of IDs for videos. internal_id and external_id. I need to find a way to enumerate internal_id but cannot guess what kind of ID this ...
2
votes
2answers
129 views

CAPTCHA w/o Server-Side Persistence

I would like to implement my own CAPTCHA challenge for a website. The framework I use implements client-side session cookies, which are not encrypted, only signed with server's private key. The ...
1
vote
1answer
168 views

Hashing sessions and retrieving them using cookie(s) with session "id" and "token"

I'm implementing custom authentication & session management system in Node.js & PostgreSQL. My goal is to implement sessions that expire after 2 weeks (if not refreshed/renewed). OWASP and ...
1
vote
0answers
89 views

Choosing the right salt to pseudo-anonymize data and be GDPR compliant

In my company, numeric user IDs are considered PIIs and therefore need to be pseudo-anonymized to be GDPR compliant. To do so, we populate a lookup table where to each ID is assigned a monotonically ...
0
votes
1answer
1k views

John the ripper not able to crack the password

I generated two hashes from this site: Plaintext 1 (p1): world Salt 1 (s1): hello Hash 1 (h1): 936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af Plaintext 2 (p2): world2 Salt 2 (s2)...
0
votes
1answer
106 views

Does hashing really make this home rolled sso process more secure?

I had configured subdomains on a site to share forms authentication, however decisions were made to change one of websites over to a different domain. So now site A needs to send a user to the site B. ...
0
votes
1answer
98 views

Is there a use for an MDC even when all messages are signed?

I guess I have halfway grasped the concepts of PGP, and I've halfway understood the concept of the Efail attack. However, I still don't understand whether such attacks would be possible (and an MDC ...
0
votes
1answer
122 views

Store a password as an identifier (as safely as possible)... since there is no other choice

I have to deal with a place that has some terrible security practices. For example, this place gives people passwords (eg. domain logon on Windows, but paired with their name as the username) that is ...
2
votes
3answers
196 views

Is it sensible to accept a password + any other random characters for successful authentication?

Supposing a user of my system has set their password to Password123 At the login screen, what would be the security implications of me accepting: Password123 or Password1234 or Password123ABC Based on ...
2
votes
3answers
278 views

To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?

I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
-1
votes
3answers
153 views

Binary versus ASCII representation of a hash - which is more secure

I am using SHA256 to create a hash. Output is captured as a text string (thus "A245B6FF") and that is what has been used to create the digital signature. Since the hash could have been ...
0
votes
1answer
209 views

Secure ajax login form

When the client is logging in, I send an xhr request to the server. However the request looks like this: localhost:80/api/login-ajax/&username=johndoe&password=123456 This is insecure for ...
1
vote
3answers
180 views

Does hashing syslog (or similar) make for good passwords?

I thought of an approach to password generation that I haven't heard of anyone else using. It almost seems too good to be true so I wonder what the downsides are. I'm well aware that you shouldn't &...
7
votes
3answers
229 views

Does there exist any hashing algorithms suitable for comparing data that is similar but not exact matches?

Does there exist any hashing algorithms suitable for comparing data that is similar but not exact matches? For example one where similar input data generates a similar hash, with the difference in the ...
0
votes
1answer
111 views

Is it possible to find out the encryption algorithm used from hexadecimal hash? [duplicate]

Can we find out the encryption method used if we know what is encrypted inside? Let's assume there are around 7-digits 22 or 26 codes (passwords ie just decimals) encrypted to 832 characters ...
0
votes
0answers
125 views

Get encrypted PDF password

For a CTF challenge, I got a locked PDF file with a data folder that contains images, a plaintext file and a wav audio file. I used pdf2john.pl to get the password hash and I performed a brute force ...
1
vote
1answer
165 views

Does using a random number of iterations for PKBDF2-SHA256 help if I only have to protect one key used to encrypt a password protecteded file? [duplicate]

I read about Recommended # of iterations when using PBKDF2-SHA256? I have also read in Why not just use a small but unusual number of hashing rounds? that when there are multiple password to protect, ...
2
votes
1answer
137 views

How to convert passphrase to AES256 key?

My plan is to convert a passphrase in UTF-8 ASCII-US to Unit8Array(32) then use it in: 256bitsKey = Unit8Array(32) from passphase iv = window.crypto.getRandomValues(new Uint8Array(32)); CryptoJS.enc....
9
votes
6answers
3k views

Can iterated hashes be used to create cryptographically secure random data from strong random seed?

I was wondering if generation of sequential hashes from random seed can be considered "random enough" to be used in cryptographic operations? By sequential hashes I mean the following: First ...
7
votes
3answers
4k views

Why not just use a small but unusual number of hashing rounds?

When it comes to hashing passwords, it is nowadays practice to do 100'000 or 200'000 iterations of SHA256/SHA512, or at least something in that ballpark. But my question is, why is it not safe enough ...
0
votes
0answers
11 views

Identify hash pattern inside a string [duplicate]

I believe that this question was answered already, though I couldn't find it. I have several strings that include hash. Each string has hash and some random (or not) add-on. How can I identify the ...
0
votes
0answers
89 views

Using predictable incrementing nonces

I need validation / feedback please with the implementation of a web based client-server application that I am building. I need to make sure that a client's cookies can't be hijacked and therefore I ...
1
vote
1answer
3k views

John the Ripper is unable to crack my SHA1 hashed password

John the Ripper is unable to crack my SHA1 hashed password: john --wordlist=rockyou.txt testing.txt Whenever I do this in Kali Linux, I get this response: Loaded 1 password hash (Raw-SHA1 [SHA1 256/...

1
2 3 4 5
43