Questions tagged [hash]
A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.
2,275
questions
1
vote
1
answer
75
views
why the ja3 hash changed everytime refresh the webpage
I am reading some articles that told the ja3 hash will help to recognize the browser fingerprints, when I i access the https://tls.browserleaks.com/json with the google chrome browser. the ja3 hash ...
- 135
0
votes
0
answers
14
views
Working Rfc2898DeriveBytes.Pbkdf2 in Java [migrated]
I have some passwords hashed with C# using Rfc2898DeriveBytes.Pbkdf2(bytes,src,5000,HashAlgorithmName.SHA1,24) (an older implementation) and would like to port this code to java.
However I don't seem ...
- 101
0
votes
0
answers
4
views
Construction of Blake2 and Cha Cha [migrated]
Recently, I was reading about Blake2B and its properties regarding randomness and security, and its connection to Daniel Bernstein's CHA CHA digest. As a budding cryptographer, I find it doable to ...
- 11
0
votes
2
answers
57
views
What does the IMAP banner alone show regarding security (STARTTLS, hashing, information disclosure)?
I encountered an open TCP/143 IMAP port which responded with this banner:
* OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=...
- 6,661
0
votes
0
answers
47
views
Mixing argon2/HKDF to generate both password hash and encryption key?
I am trying to use a user password in my application to both generate a password hash (for authentication) and to derive a secret key to encrypt user data.
Using argon2 is an expensive operation so i ...
- 101
1
vote
1
answer
104
views
Is it possible to check for pwned/common passwords using salted hashes of the passwords?
If I administer a webpage that allows users to create accounts, and assuming I don't keep or even ever have access to plaintext passwords, is it possible for me to detect that one of my users is using ...
- 115
1
vote
1
answer
66
views
Is there any benefit to use different salt for different encryption algorithms for same user
There is two different passwords for a single user.
I'm hashing both for future validation. I'm currently using a single unique salt for the user, but each is hashed with a different algorithms (...
- 111
0
votes
0
answers
34
views
PGP keys as a hashing method
The context is described in another of my question, and is as follow : i've got to securely store identifiers, called TIP. We need (1) a method to derive always the same UID from a TIP, so that no ...
- 133
0
votes
0
answers
86
views
What to do if i have no salt?
Here is my situation : we've got ID, named TIP, from remote and large databases. We want to store all the data, but laws prevents us to store the TIP directly, but rather anonymize them, for security ...
- 133
0
votes
0
answers
27
views
Any idea on how this 36 character long string generated? [duplicate]
I have a personal id "U1KFhYtMqZhCYya6sy31PVLM8DlM5HLCkwy3", I have checked some hash functions but cannot make sure how this generated? Is this just random string generated with [a-zA-z0-9]?...
- 101
0
votes
0
answers
35
views
Why are Laravel's refresh tokens so big?
Laravel Passport implements OAuth2 flows and does the usual thing of issuing access tokens in JWT format, and an opaque random string as the refresh token. These refresh tokens are enormous - around ...
- 717
13
votes
4
answers
4k
views
Is it common practice to take multiple hashes of the same object?
I was recently participating in a CTF with a challenge that required contestants to find two .pdf files with the same md5 hash, and that got me thinking about how that could be a potential ...
- 246
0
votes
0
answers
48
views
ow do I move password securely between api and web?
I would like to ask how I should go about securely transmitting the password between two applications. I have two projects that work with each other. The first one is a project called AuthApi, which ...
- 1
0
votes
2
answers
132
views
Should I be concerned that my bank told me that I have a strong password? [duplicate]
I recently ran an account security check through my bank's web site, and my bank "reassured" me that I have a strong password.
Should I be concerned that they know that? I had assumed that ...
- 151
0
votes
0
answers
23
views
Retrieve TOTP seed from tokens and timestamps [duplicate]
I recently switched to or added the option to use time-based one time passwords, TOTP, as the second factor for some services I use. It got me wondering if it's possible to retrieve the secret seed if ...
- 402
0
votes
0
answers
46
views
What are password encryption schemes that result in variable length common in MySQL and PHP?
I have stumbled across passwords on a MySQL database behind a PHP webapp. Here are some examples.
753a524d56b48d825328ce27
789e0ad30d15
7ba0868c23e0a2
d327e265ca2abcd7c
48276b3d5618850
...
- 1
-2
votes
1
answer
152
views
Is it possible to bruteforce SHA256? [duplicate]
SHA256, 64 characters using only 0-9 or lowercase a-f
Making 1.15792089E+77 total possible combinations. Is it possible to crack the input for its given hash?
- 1
1
vote
2
answers
423
views
Encrypted 7z file password not working
I'm in an interesting predicament. I have an encrypted 7z file that I made myself. The password for the file is a 60 character generated password that I saved to my password manager. I made sure to ...
- 113
2
votes
1
answer
156
views
John the Ripper - Zip Password help - Latter half digit command advice
I'm trying to use John to recover some old ZIP files with a password I remember half. One half being a word, the latter half being a mix of four to six digits.
I remember the word, but not the digits ...
- 21
0
votes
0
answers
15
views
Dump Windows 11 PIN hash [duplicate]
Can anyone tell me how to dump the Windows 11 PIN? I tried dumping SAM and SYSTEM but the PIN hash is not there. What mode we can use in hashcat to crack it?
1
vote
1
answer
72
views
Key Hash With Securely-Optimal Setting : For Encryption vs For Password
Do you have to make a key hash with securely-optimum setting (eg. 100MB memlimit, 3 opslimit) for encryption ?
So I'm making a text encryption function with javascript, using XChaCha20-Poly1305 and ...
-2
votes
1
answer
114
views
Using base64 for secure encoding [duplicate]
Now this may seem like a stupid question, but it just occurred to me: How secure is base64 encoding compared to (plain) hashing?
Nobody can read base64 code by itself, but it still isn't that hard to ...
- 269
0
votes
1
answer
43
views
Saving the code of a ticket unhashed
I am making a simple ticketing system for a small local party so people can order their tickets for the party online.
It works like this:
The user enters his info.
He pays for the ticket.
If the ...
- 2,770
0
votes
1
answer
200
views
How to create a hash file of a .dmg file for use in JTR?
I have a .dmg file on my MacBook. I have forgotten the password of the .dmg file and now I'm not able to access the files in it.
I tried using John the Ripper. However, whenever I run john --format=...
- 1
1
vote
1
answer
189
views
john the ripper tool - how to combine wordlist with incremental modes?
In hashcat, when we need to crack password based on wordlist, but additionally want to try partly bruteforce random ASCII characters in the end of any entry from the wordlist, we can use the following ...
- 13
0
votes
1
answer
74
views
Applying application-level signing in HTTP
I have to secure HTTP requests`s body on application layer, so I wanted to generate signatures with hash of body and the receiver will validate it.
But I can do it in different way and apply it into ...
- 309
0
votes
1
answer
60
views
How is the npm package manager made robust security-wise, what are the keys they are using, and how do they use them?
I am specifically looking at the npm package metadata like from the lodash package, the relevant part which is this:
{
"shasum": "392617f69a947e40cec7848d85fcc3dd29d74bc5",
&...
- 618
2
votes
2
answers
275
views
Where or how to persist a decryption key in a React app?
I'm making a web application on the MERN stack which stores sensitive user data, in the form of a big block of text.
The encryption method I am using is that when a user registers, a random key is ...
- 21
0
votes
1
answer
222
views
Is a leaked encrypted password more secure than a leaked hash?
Encryption tech is obviously intended to secure things that we want to be private over an insecure medium. When I log into a site for example, my password is transmitted over HTTPS, hashed by the ...
- 371
1
vote
1
answer
145
views
Two different salted hashes of the same password for the same user
I am creating an authentication system that is able to login to the same account with different sets of credentials. I also want to allow users to login with either username or email with the same ...
- 11
0
votes
1
answer
99
views
Fuzzy hash of a file
Could someone please explain this to me: When you use a fuzzy hash algorithm (ssdeep, tlsh, sdhash... or any other) to calculate the hash value of a file, does it calculate the hash based on the whole ...
- 35
1
vote
1
answer
219
views
What is the effect of salt and no. of rounds in mkpasswd encryption?
I'm currently trying to understand how salting and no. of rounds work using mkpasswd. These are the commands that I have been experimenting around.
cp@cp-vm:~/Asg2_Task1b$ time mkpasswd -m sha-512 ...
- 11
2
votes
1
answer
251
views
What are the threats of using hashing functions that are built into the DBMS? (besides man-in-the-middle attacks)
There are functions like MD5 and SHA2 in MySQL which can be used to hash values before putting them into the database, or when searching over values.
As I proposed a possible solution in a comment to ...
- 63
1
vote
2
answers
126
views
What's the shortest message you need to claim ownership of another message?
Hypothetically, I'd like to demonstrate that I am the owner of a piece of published information. The requirements are the following.
The hash/ characteristic string is compact enough (ideally a few ...
- 121
4
votes
4
answers
754
views
Using hashed trigrams to search over encrypted data
For practice, I write let's call it a notebook app that stores users' notes in AES-encrypted form. For encryption, I use a password-based intermediate key technique as described here. Actually, the ...
- 63
3
votes
2
answers
772
views
How can I identify the salt value used in a password hash?
I'm currently learning about password cracking, and I have a set of passwords with their respective hash values. I used Hashcat to crack the hash values, just to see how it works, but I got different ...
14
votes
6
answers
8k
views
Is it possible to generate a file with a given sha256sum checksum?
Is it possible to generate a file with a given sha256sum checksum?
That is, reverse the process of a sha256sum checksum. That is, if we have a checksum, can we generate txt file data (need not be ...
- 213
14
votes
2
answers
4k
views
Reasoning behind banning '#' from the start of passwords? [duplicate]
Today, on an official government website, I came across the following password rules:
"Your password has to be at least 8 characters long. It can't have any blank spaces. It has to use characters ...
- 141
5
votes
3
answers
391
views
Using Proof of Work to slow down login attempts
For a while I've been pondering a user authentication protocol that aims to ensure that a client does some computational work before the server will attempt to authenticate the password.
The reason ...
- 153
1
vote
0
answers
34
views
How should an argon2 hash be stored? [duplicate]
Given the following argon2 hash
$argon2id$v=19$m=65536,t=32,p=8$mJmKA5qamzXOPJZYw4wCEUKY$COkMH0RckaZ/3bhYCdCQjLuzoLKxcAmk4TzmHRRgTQ8
How should the hash be stored in a database? From the answers of ...
- 11
1
vote
3
answers
365
views
How do websites check that password hashes saved in the database are the same as passwords hashed client-side?
How do websites check that password hashes saved in the database are the same as passwords hashed and sent by a client?
I know that client-side hashing is not secure.
- 21
1
vote
0
answers
28
views
Argon2 is worse than bcrypt at runtimes < 1000 ms? [duplicate]
While Argon2 seems to be recommended for password hashing, based on this twit Argon2 is worse than bcrypt at runtimes < 1000 ms.
Based on this answer:
You should tweak the parameters to your own ...
- 111
0
votes
1
answer
215
views
Storing two hashes of same password?
Typically for user passwords we store their hashes and salt alongside in the database - one per user.
I wonder the security implications of hashing the same password twice and storing locally both.
...
0
votes
1
answer
402
views
How long would it take to crack hashed password stored in plain sight?
I want to store a password hash in plain sight. If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long would it take (assuming my password is ...
0
votes
0
answers
65
views
How to find the correspond hash algorithm? [duplicate]
I'm currently working on a project. but i still facing some issue due to some crypted data. i know the plaintext and got the correspond hash.
plaintext: C018AE45B37DAE665486F4151E0C1E6F
Hash: rROkd+...
- 11
0
votes
1
answer
135
views
Is it possible to use hashcat or john the ripper on a .drmz file?
I have n .drmz files which I can read with Javelin PDF Reader. Obviously to access the content I need a password, which I have, the same for each file.
In case I don't have the password is there a way ...
- 3
0
votes
1
answer
166
views
How does this app "hash" their passwords with MD5, but still know the plain-text?
There is a public application that has terrible security practices. When performing an API call to such application, and succesfully logging in, it will return a "user" JSON that includes ...
3
votes
4
answers
2k
views
Using a Client and Server secret to double salt a hash
I want to log IP addresses visiting my site, for aggregated statistics only and to see if the same IP address has visited twice. But I don't want to expose them.
My Idea is in my database.
$...
- 131
0
votes
0
answers
348
views
Cracking an MD5 password with little info to go off of
I am taking a security class and part of an assignment this week is to crack a given MD5 hash.
All the professor has given us for this task is the hash, the knowledge that the password is 6 or 7 ...
- 1
1
vote
0
answers
81
views
The hash of kali-linux-2022.4-raspberry-pi-arm64.img.xz changed after burning it into an sd card
I was burning an iso file into the sd card with pi imager and I doubled checked the hash before the burning and after and I got different results
sha256sum kali-linux-2022.4-raspberry-pi-arm64.img.xz
...
