Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

1
vote
2answers
51 views

Is storing the bcrypt salt in isolated database a good idea?

I read many answers on the stackexchange about Bcrypt, Salt and Where exactly to place the salt. For hashes such as BCrypt it is trivial to extract salt from the hash. So, It doesn't matter really ...
0
votes
0answers
10 views

IBM DSR PE disk

Does anyone know how to use the IBM DSR PE boot disk to show user accounts and reset a password for any one of the shown accounts?
-4
votes
1answer
109 views

If I hash a password 40 times, will it be breach proof? [duplicate]

Let's say I have a password like: password123 If I was to hash it 30 times, will it be (nearly) breach proof? I have a loop which goes through all the hashing algorithms and hashes them continuously. ...
2
votes
2answers
95 views

HMAC and key size

I generated a keyed hash using HMAC-MD5 and HMAC-SHA256 for an arbitrary file with various keys of different lengths. Do we have to use a key with a fixed size in HMAC? If so, what is the key size? ...
0
votes
0answers
49 views

could anyone help me to know what kind of password is this? [closed]

User:"$2:fqV'72G[<kABp5{rU^WIiuh~Zk3z*7Fs=3-(E73$" please help me to know my user account in my modem thanks
0
votes
0answers
25 views

FIlemaker: passwords' hashes location [closed]

Where does Filemaker store the passwords' hashes of its files when a user has protected them with a password? (location of the hash file)
0
votes
0answers
30 views

Does a small max password length indicate there might be a security issue? [duplicate]

Some websites state specific requirements for a password when you create an account. Some are understandable, but in particular the maximum password length doesn't make sense to me. Some websites ...
4
votes
6answers
431 views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
9
votes
2answers
1k views

Is there a loss of entropy by hashing an N-bit random key to produce an N-bit hash?

I read the following piece of code: dd if=/dev/urandom bs=16 count=1 2>/dev/null | md5sum Apparently, this code was used as a trick to produce a hex string key from a 128-bit binary pseudo-random ...
0
votes
0answers
36 views

Where do salts come from? [duplicate]

A salt can be a random value and length. The hash and the salt are stored in the database. Is there a separate salt generator function used? Is it just a random generator? Does it need to be a ...
5
votes
3answers
158 views

What are the 'P' values in some cipher string?

Most of the cipher strings I see are in the format: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ...
0
votes
1answer
25 views

Generate DEK from password using hashing on client-side

Important to know Will not be passing the DEK from client to the server The DEK will be used to encrypt all the data being placed within a github repository, it is possible that cipher-text will be ...
-1
votes
1answer
110 views

Does salted password hashes expose users with blank passwords?

Traditionally, a 'salted' hash of the password is stored along with the salt so there is no plaintext in the database and still be able to authenticate the password. The salting process consists of ...
-1
votes
2answers
90 views

Can the following hash technique be reversed? If so, would it be difficult?

I was wondering if the following hashing technique can easily be reversed? If someone got hold of the hashed value, can he/she reverse it? Partiuclarly I'm talking about the following code: ...
2
votes
1answer
45 views

Private contact discovery - calculating probability of false positive

I'm working on contact discovery for a service and want to do it in a way that maintains privacy as much as possible, without using Signal's Private Contact Discovery Service (https://signal.org/blog/...
0
votes
0answers
60 views

How to securely store private keys in the DB?

I am implementing a web application that deals with signing blockchain transactions similar to what all cryptocurrency stock exchange applications are doing. I am wondering how do they store private ...
0
votes
0answers
23 views

Get hash and iv from V file in SAM folder Windows 10

Using information from this link: http://www.insecurity.be/blog/2018/01/21/retrieving-ntlm-hashes-and-what-changed-technical-writeup/#New_Style_Hash_Retrieval I try to do the same thing on VM with ...
0
votes
1answer
69 views

AES Keys Storage for encrypting hashes of SAM file in Windows 10

Hashes of user account passwords in Windows 10 (like in older versions) are stored in SAM file. Using standard utility pwdump 7 for getting these hashes gives following result: ::LM hash : NTLM hash ...
1
vote
2answers
132 views

Encryption and Hash algorithms explanation

I am using Veracrypt and there are encryption and hash algorithms Can anyone explain simply what do each algorithm does? Encryption algorithms encrypt your data/file, Hash algorithm hashes your ...
1
vote
1answer
83 views

Is it safe to reuse a user's hashed password as his token in the email confirmation link?

The user password is hashed with bycrypt. According to this answer: bcrypt is not an encryption function, it's a password hashing function, relying on Blowfish's key scheduling, not its encryption. ...
0
votes
0answers
60 views

How Windows 8 and Windows 10 hash account password?

I need some accurate information about how Windows 8 and Windows 10 perform hashing user account passwords. I know that they are stored in SAM file and NTLMv2 algorithm is used. But while using ...
21
votes
2answers
5k views

Hashing email addresses for GDPR compliance

UPDATED We have a very unique scenario: We have several old databases of user accounts. We'd like a new system to be able to connect these old accounts to new accounts on the new system, if the user ...
0
votes
1answer
47 views

How to prevent replay attacks without exposing stored password security?

A common way to prevent replay attacks when logging in is for the server to present a challenge (chall) and request a response in the form hash(chall+secret) where the secret is already known by the ...
0
votes
1answer
70 views

hashcat specify number of characters

I am trying to figure out a macOS hash 10.8+ and I happen to know that it uses A-Z, a-z, 0-9, is 6-8 characters, and almost certainly random. Currently, it spits out an error regarding hash length ...
-1
votes
1answer
38 views

Is a md5 actually unable to be reversed? [duplicate]

If a md5 is one way and supposedly unable to be reversed why do we still have large data breeches with user names and passwords. Are these companies storing passwords in plain text?
1
vote
2answers
75 views

Is there any advantage to combining a hash algorithm with a key-derivation function?

Let's assume I would like to secure passwords using a modern KDF such as Argon2. The flow of information would look like this: $hash,$salt = argon2id($password, $salt). Is there any advantage to ...
3
votes
2answers
130 views

How can a client verify that code sent from the server has not been tampered with?

While trying to understand the recent controversy involving ProtonMail, I started to wonder if its possible to verify that the opensource JavaScript being sent from the server to the client hasn't ...
0
votes
1answer
35 views

How are these transaction fingerprints colored?

For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
2
votes
2answers
320 views

Is it worth storing email addresses as hashes?

If your running a web services with lots of users and you get hacked, you may be giving away users's plain text information like email and hashes like password hashes. Is it worth storing email ...
0
votes
1answer
169 views

Why is a 32 character hex string not a md5 hash? [closed]

This string, when dropped into hash detection tools, is not being identified as a hash. As far as I knew, an md5 has was a 32 digit string with hex numbers. Everything below is hex. So what other ...
1
vote
1answer
77 views

Can I identify a hash function with neural network?

Can I use neural network to identify a hash function like sha256? I mean, generate a bunch of hash codes by different hash functions and also labels. Then, feed these codes into a neural network. Will ...
1
vote
1answer
337 views

Using hashcat in order to crack the JWT signature in WebGoat

I've recently started to practice my penetration testing skills and I got started with WebGoat. I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT ...
1
vote
0answers
17 views

What is better way of transmitting password input? Plaintext or its hash value? [duplicate]

Let's just say there is a client and a server. The end-user inputs his/her password in the client interface. Then the data will be sent to the server for validation. In terms of security, would it be ...
0
votes
1answer
69 views

Using the filehash as the key [closed]

I want to ensure that everyone who encrypts a given file gets the same encrypted file without knowing the password. So, my idea was the following: hash the file encrypt the file (e.g. AES) with the ...
0
votes
1answer
60 views

what is the best algorithm for hashing stored users info on client-side on a web app

I have this scenario in a web app which I'm working on its client-side code(I'm building it with ReactJS): I obtain user's info hash 'em send it to the server for being authenticated and when I get ...
1
vote
1answer
60 views

Why do some websites have their hashes on the same area as the download link? [duplicate]

Some sites allow us to use hashes to make sure that the file we download is what it should be and that it is not tampered with. Some sites may have their hashes on a different domain probably on a ...
1
vote
1answer
124 views

How to crack a list of hashed passwords given their possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256 using some java code. I have the hashes available and I also have the possibilities in which the password can be. Some ...
0
votes
1answer
57 views

Hash to malware file generation

I was watching a video from one of the youtube channel on reverse engineering. One of the topic is how to get free malware for static analysis. During the discussion, it was mentioned that people can ...
0
votes
1answer
74 views

What is a collision attack in simple terms? [closed]

I'm not a security expert but I've got interested in Cryptography and I'm reading about it. I was trying to find out which is the best between SHA256, Bcrypt and MD5 when it comes to hashing ...
0
votes
0answers
101 views

How is a birthday attack actually performed?

I thought I understood the birthday attack until I tried to actually implement it. Either I'm implementing it wrong, or there's something wrong with my interpretation of the resulting probabilities. ...
0
votes
0answers
46 views

How do I combine a salt and hash for John The Ripper? [duplicate]

I found a password hash *61A2BD98DAD2A09749B6FC77A9578609D32518DD I found a salt somewhere else. How do I combine these to feed into John the Ripper? When I run John on the hash (minus the *) John ...
1
vote
2answers
120 views

Best way to encrypt a username in a database?

In my database, I would like to encrypt every identifiable piece of information, including the username, such that people with access to the database cannot deduce the actual username (because it ...
0
votes
1answer
48 views

Are all fields of the PE certificate directory hashed during authenticode signing?

In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
4
votes
2answers
305 views

How does a zip file detect a correct password?

When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file. How does an encrypted ZIP detect when the user has given the correct ...
1
vote
2answers
117 views

How to crack a password given its hash and its possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256. I have the hashes available and I also have the possibilities in which the password can be. Some of these possibilities ...
1
vote
1answer
612 views

I know salt and hash(password + salt), how do I get hash(password)?

...If it's possible at all. By hash I mean md5, sha1, sha256. And how difficult is it? I mean, if it's possible mathematically, are there any tools around?
1
vote
2answers
315 views

Which hashing algorithm shoud I use for a safe file checksum?

For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them. To protect the integrity of the work I have done and to guarantee it has never ...
3
votes
1answer
52 views

Can I securely keep the user logged into my local application AND use the password as a decryption key?

I'm somewhat new to data encryption/safety, but I already read about basic concepts like hashing passwords, encrypting files, etc. If possible, please ELI5 - thanks in advance. Background: my ...
2
votes
3answers
170 views

Password-hash proofing SHA-3

I am in a situation where I need to harden a password hash, but not allowed to bring in any extra dependencies, so I am pretty much forced to do the one thing everyone seems to advise against - roll ...
0
votes
1answer
39 views

Password hashing on both client and server : what are the risks concerning hash composition (collisions and reversing)?

There are plenty of question addressing the "client / server : where to hash ?", but i have not found anything about my particular question : considering a server_salted_hash(client_salted_hash(...