Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0 votes
1 answer
72 views

Crack hash with given salt and dictionary [duplicate]

pbkdf2:sha256:600000$m28HtZYwJYMjkhJ5$2d481c9f3fe597390e4c4192f762188bf311e834030a11e069019015fb336c14 This is the format in which I have the hash. I also have a dictionary which consists of the ...
Ankeet Saha's user avatar
2 votes
4 answers
6k views

Is this idea for secure password storage a good one?

Being interested in security, hashing in particular, I thought of a strategy that could either help or compromise password security. The main way to ‘break’ hashes is to brute force them. So, while ...
security_paranoid's user avatar
1 vote
5 answers
213 views

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

I'm working on making an end-to-end encrypted app that will store sensitive mental health information. The goal is to make it completely impossible for someone with access to the server to see the ...
Gradyn Wursten's user avatar
4 votes
3 answers
2k views

How to track PBKDF2 progress?

Background: We have an application with password authentication. We now need to raise the number of PBKDF2-iterations and this means that the login takes quite a bit longer than before. Therefore, ...
n-l-i's user avatar
  • 326
0 votes
2 answers
113 views

How do databases/companies change their hashing algorithm? [duplicate]

Ok- so you all probably know that a hash is used to help secure a stored password in a database, if it was stolen. When a user logs in, and enters a password, it gets hashed, and then matched to a ...
security_paranoid's user avatar
-1 votes
1 answer
92 views

Is there anyway to crack this salted Hash? [closed]

The Task is kind of a CTF task that I was given and I have no idea how to do this. I had to crack a password on a zipfile and then crack the 3 hashes in the txt file within the zip file. I cracked the ...
Wrex's user avatar
  • 9
3 votes
1 answer
106 views

Why does OWASP recommend only 1 degree of parallelism for Argon2id

Referencing this document, they give justifications for a number of their recommendations, but not any behind only going with 1 degree of parallelism for using Argon2id. Is there a reason why this is ...
Jesse C. Slicer's user avatar
0 votes
0 answers
52 views

How to verify the integrity of all binaries of packages installed manually via installers and dpkg on Debian/Linux?

How could one verify the integrity of all binaries of packages installed manually via installers and dpkg on Debian/Linux? So far the only thing I could think of is this: verify that which veracrypt ...
mYnDstrEAm's user avatar
0 votes
1 answer
51 views

Question about storing salt values and hashed passwords in the database [duplicate]

So I was reading through an article about how passwords are salted and hashed through a cryptographic function here, and found out that hashed passwords, along with the plaintext salt values are ...
mantot123's user avatar
0 votes
1 answer
57 views

Storing the hash of the plaintext and the encrypted plaintext next to each other [closed]

I generate a random string of 32 characters and then compute the SHA-512 hash then I encrypt the unhashed string. I then save the encrypted text and hash to the database. Is it okay to store the hash ...
user avatar
0 votes
2 answers
169 views

How bad would a Hash algorithm leak would be?

Context: When the Twitch whole code repository was leaked, it created multiple discussions on social medias. And one day I was on Reddit and said that the leak of the hashing algorithm and the salt ...
CARLOS EDUARDO NISHI's user avatar
1 vote
1 answer
436 views

Converting zip2john output to hashcat

I have video files stacked in zip and I forgot the password. I want to use hashcat, because john will take much longer, but the hash from hash zip2john isn't compatible and I don't know how to convert ...
GMike's user avatar
  • 11
1 vote
2 answers
190 views

Weak password hash + strong rate limiter = secure?

I have a microservice which sole purpose is to serve as a cache for other microservices. The point of the cache is to speed up processing, but the strong password hash algo counter that purpose. (...
Jasper Citi's user avatar
0 votes
1 answer
115 views

Algorithms when using client side hashing plus server side hashing

So if I got this right from my intense research, the following procedure would be preferrable: Use the PBKDF2 key derivation function to derive a secret key from the users password on the client side. ...
shaniag's user avatar
0 votes
1 answer
199 views

Passwords/password hashes in plaintext in service configs - why is this common practice?

A while ago I wanted to deploy a service using a OCI (docker/podman) container, and I noticed to me, what seemed like a possibly distributing trend. In the build file for a lot of the containers, the ...
The Floating Brain's user avatar
0 votes
0 answers
64 views

Trouble understanding hash_extension tool examples for hash length extension attack (C#)

I am trying to follow the example of how a hash length extension attack works using the article here: https://www.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks ...
arvedellis's user avatar
0 votes
4 answers
2k views

Can somebody explain simply why crypt of a password with a salt (the hash result) is equal to crypt of the password with the hash result itself?

Can somebody explain simply why crypt of a password with a salt (the hash result) is equal to crypt of the password with the hash result itself ? Surely there is a simple mathematical explanation. I ...
Winston L's user avatar
0 votes
0 answers
87 views

Revoking a digital signature at the cryptographic level

How do I indicate that a specific document or transaction associated with a particular signature should no longer be considered valid? I'm talking of recalling a signed document, not revoking the ...
microwth's user avatar
  • 2,473
1 vote
0 answers
90 views

Hash function the other way around [closed]

Is there anything that works like the opposite of a hash algorithm? Today we know many hash algorithms, which take an input, perform some math on it, and output a value which is different than the ...
Finn 's user avatar
  • 11
1 vote
1 answer
569 views

why the ja3 hash changed everytime refresh the webpage

I am reading some articles that told the ja3 hash will help to recognize the browser fingerprints, when I i access the https://tls.browserleaks.com/json with the google chrome browser. the ja3 hash ...
Dolphin's user avatar
  • 135
0 votes
2 answers
147 views

What does the IMAP banner alone show regarding security (STARTTLS, hashing, information disclosure)?

I encountered an open TCP/143 IMAP port which responded with this banner: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=...
Bob Ortiz's user avatar
  • 6,665
0 votes
0 answers
170 views

Mixing argon2/HKDF to generate both password hash and encryption key?

I am trying to use a user password in my application to both generate a password hash (for authentication) and to derive a secret key to encrypt user data. Using argon2 is an expensive operation so i ...
codestation's user avatar
1 vote
1 answer
162 views

Is it possible to check for pwned/common passwords using salted hashes of the passwords?

If I administer a webpage that allows users to create accounts, and assuming I don't keep or even ever have access to plaintext passwords, is it possible for me to detect that one of my users is using ...
terdon's user avatar
  • 115
1 vote
1 answer
132 views

Is there any benefit to use different salt for different encryption algorithms for same user

There is two different passwords for a single user. I'm hashing both for future validation. I'm currently using a single unique salt for the user, but each is hashed with a different algorithms (...
user526498's user avatar
0 votes
0 answers
78 views

PGP keys as a hashing method

The context is described in another of my question, and is as follow : i've got to securely store identifiers, called TIP. We need (1) a method to derive always the same UID from a TIP, so that no ...
aluriak's user avatar
  • 133
0 votes
0 answers
133 views

What to do if i have no salt?

Here is my situation : we've got ID, named TIP, from remote and large databases. We want to store all the data, but laws prevents us to store the TIP directly, but rather anonymize them, for security ...
aluriak's user avatar
  • 133
0 votes
0 answers
27 views

Any idea on how this 36 character long string generated? [duplicate]

I have a personal id "U1KFhYtMqZhCYya6sy31PVLM8DlM5HLCkwy3", I have checked some hash functions but cannot make sure how this generated? Is this just random string generated with [a-zA-z0-9]?...
Slybot's user avatar
  • 101
0 votes
0 answers
88 views

Why are Laravel's refresh tokens so big?

Laravel Passport implements OAuth2 flows and does the usual thing of issuing access tokens in JWT format, and an opaque random string as the refresh token. These refresh tokens are enormous - around ...
Synchro's user avatar
  • 717
13 votes
4 answers
4k views

Is it common practice to take multiple hashes of the same object?

I was recently participating in a CTF with a challenge that required contestants to find two .pdf files with the same md5 hash, and that got me thinking about how that could be a potential ...
Blue Herring's user avatar
0 votes
0 answers
90 views

ow do I move password securely between api and web?

I would like to ask how I should go about securely transmitting the password between two applications. I have two projects that work with each other. The first one is a project called AuthApi, which ...
nikki's user avatar
  • 1
0 votes
2 answers
178 views

Should I be concerned that my bank told me that I have a strong password? [duplicate]

I recently ran an account security check through my bank's web site, and my bank "reassured" me that I have a strong password. Should I be concerned that they know that? I had assumed that ...
Very Tiny Brain's user avatar
0 votes
0 answers
29 views

Retrieve TOTP seed from tokens and timestamps [duplicate]

I recently switched to or added the option to use time-based one time passwords, TOTP, as the second factor for some services I use. It got me wondering if it's possible to retrieve the secret seed if ...
FalcoGer's user avatar
  • 392
0 votes
0 answers
87 views

What are password encryption schemes that result in variable length common in MySQL and PHP?

I have stumbled across passwords on a MySQL database behind a PHP webapp. Here are some examples. 753a524d56b48d825328ce27 789e0ad30d15 7ba0868c23e0a2 d327e265ca2abcd7c 48276b3d5618850 ...
knods's user avatar
  • 1
-2 votes
1 answer
325 views

Is it possible to bruteforce SHA256? [duplicate]

SHA256, 64 characters using only 0-9 or lowercase a-f Making 1.15792089E+77 total possible combinations. Is it possible to crack the input for its given hash?
San's user avatar
  • 1
1 vote
2 answers
1k views

Encrypted 7z file password not working

I'm in an interesting predicament. I have an encrypted 7z file that I made myself. The password for the file is a 60 character generated password that I saved to my password manager. I made sure to ...
CSstudent's user avatar
  • 113
2 votes
1 answer
270 views

John the Ripper - Zip Password help - Latter half digit command advice

I'm trying to use John to recover some old ZIP files with a password I remember half. One half being a word, the latter half being a mix of four to six digits. I remember the word, but not the digits ...
LEGEND-001's user avatar
0 votes
0 answers
31 views

Dump Windows 11 PIN hash [duplicate]

Can anyone tell me how to dump the Windows 11 PIN? I tried dumping SAM and SYSTEM but the PIN hash is not there. What mode we can use in hashcat to crack it?
Ayush Mishra's user avatar
1 vote
1 answer
117 views

Key Hash With Securely-Optimal Setting : For Encryption vs For Password

Do you have to make a key hash with securely-optimum setting (eg. 100MB memlimit, 3 opslimit) for encryption ? So I'm making a text encryption function with javascript, using XChaCha20-Poly1305 and ...
Agus Setiawan's user avatar
-2 votes
1 answer
247 views

Using base64 for secure encoding [duplicate]

Now this may seem like a stupid question, but it just occurred to me: How secure is base64 encoding compared to (plain) hashing? Nobody can read base64 code by itself, but it still isn't that hard to ...
Parking Master's user avatar
0 votes
1 answer
85 views

Saving the code of a ticket unhashed

I am making a simple ticketing system for a small local party so people can order their tickets for the party online. It works like this: The user enters his info. He pays for the ticket. If the ...
O'Niel's user avatar
  • 2,914
0 votes
1 answer
691 views

How to create a hash file of a .dmg file for use in JTR?

I have a .dmg file on my MacBook. I have forgotten the password of the .dmg file and now I'm not able to access the files in it. I tried using John the Ripper. However, whenever I run john --format=...
ange1o's user avatar
  • 1
1 vote
1 answer
574 views

john the ripper tool - how to combine wordlist with incremental modes?

In hashcat, when we need to crack password based on wordlist, but additionally want to try partly bruteforce random ASCII characters in the end of any entry from the wordlist, we can use the following ...
Hans R's user avatar
  • 13
0 votes
1 answer
167 views

Applying application-level signing in HTTP

I have to secure HTTP requests`s body on application layer, so I wanted to generate signatures with hash of body and the receiver will validate it. But I can do it in different way and apply it into ...
Szyszka947's user avatar
0 votes
1 answer
103 views

How is the npm package manager made robust security-wise, what are the keys they are using, and how do they use them?

I am specifically looking at the npm package metadata like from the lodash package, the relevant part which is this: { "shasum": "392617f69a947e40cec7848d85fcc3dd29d74bc5", &...
Lance's user avatar
  • 632
2 votes
2 answers
636 views

Where or how to persist a decryption key in a React app?

I'm making a web application on the MERN stack which stores sensitive user data, in the form of a big block of text. The encryption method I am using is that when a user registers, a random key is ...
lostCoder's user avatar
1 vote
1 answer
441 views

Is a leaked encrypted password more secure than a leaked hash?

Encryption tech is obviously intended to secure things that we want to be private over an insecure medium. When I log into a site for example, my password is transmitted over HTTPS, hashed by the ...
joshperry's user avatar
  • 391
1 vote
1 answer
307 views

Two different salted hashes of the same password for the same user

I am creating an authentication system that is able to login to the same account with different sets of credentials. I also want to allow users to login with either username or email with the same ...
the Radek's user avatar
0 votes
1 answer
186 views

Fuzzy hash of a file

Could someone please explain this to me: When you use a fuzzy hash algorithm (ssdeep, tlsh, sdhash... or any other) to calculate the hash value of a file, does it calculate the hash based on the whole ...
Moooz's user avatar
  • 35
1 vote
1 answer
491 views

What is the effect of salt and no. of rounds in mkpasswd encryption?

I'm currently trying to understand how salting and no. of rounds work using mkpasswd. These are the commands that I have been experimenting around. cp@cp-vm:~/Asg2_Task1b$ time mkpasswd -m sha-512 ...
Chloe's user avatar
  • 11
2 votes
1 answer
294 views

What are the threats of using hashing functions that are built into the DBMS? (besides man-in-the-middle attacks)

There are functions like MD5 and SHA2 in MySQL which can be used to hash values before putting them into the database, or when searching over values. As I proposed a possible solution in a comment to ...
v_slav.b's user avatar

1
2 3 4 5
46