Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

1
vote
2answers
43 views

Is there any advantage to combining a hash algorithm with a key-derivation function?

Let's assume I would like to secure passwords using a modern KDF such as Argon2. The flow of information would look like this: $hash,$salt = argon2id($password, $salt). Is there any advantage to ...
1
vote
1answer
66 views

How can a client verify that code sent from the server has not been tampered with?

While trying to understand the recent controversy involving Protonmail, I started to wonder if its possible to verify that the opensource JavaScript being sent from the server to the client hasn't ...
0
votes
1answer
22 views

How are these transaction fingerprints colored?

For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
2
votes
2answers
279 views

Is it worth storing email addresses as hashes?

If your running a web services with lots of users and you get hacked, you may be giving away users's plain text information like email and hashes like password hashes. Is it worth storing email ...
0
votes
1answer
149 views

Why is a 32 character hex string not a md5 hash? [closed]

This string, when dropped into hash detection tools, is not being identified as a hash. As far as I knew, an md5 has was a 32 digit string with hex numbers. Everything below is hex. So what other ...
1
vote
1answer
74 views

Can I identify a hash function with neural network?

Can I use neural network to identify a hash function like sha256? I mean, generate a bunch of hash codes by different hash functions and also labels. Then, feed these codes into a neural network. Will ...
1
vote
1answer
121 views

Using hashcat in order to crack the JWT signature in WebGoat

I've recently started to practice my penetration testing skills and I got started with WebGoat. I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT ...
1
vote
0answers
17 views

What is better way of transmitting password input? Plaintext or its hash value? [duplicate]

Let's just say there is a client and a server. The end-user inputs his/her password in the client interface. Then the data will be sent to the server for validation. In terms of security, would it be ...
0
votes
1answer
69 views

Using the filehash as the key [closed]

I want to ensure that everyone who encrypts a given file gets the same encrypted file without knowing the password. So, my idea was the following: hash the file encrypt the file (e.g. AES) with the ...
0
votes
1answer
58 views

what is the best algorithm for hashing stored users info on client-side on a web app

I have this scenario in a web app which I'm working on its client-side code(I'm building it with ReactJS): I obtain user's info hash 'em send it to the server for being authenticated and when I get ...
1
vote
1answer
47 views

Why do some websites have their hashes on the same area as the download link? [duplicate]

Some sites allow us to use hashes to make sure that the file we download is what it should be and that it is not tampered with. Some sites may have their hashes on a different domain probably on a ...
1
vote
1answer
98 views

How to crack a list of hashed passwords given their possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256 using some java code. I have the hashes available and I also have the possibilities in which the password can be. Some ...
0
votes
1answer
55 views

Hash to malware file generation

I was watching a video from one of the youtube channel on reverse engineering. One of the topic is how to get free malware for static analysis. During the discussion, it was mentioned that people can ...
0
votes
1answer
69 views

What is a collision attack in simple terms? [closed]

I'm not a security expert but I've got interested in Cryptography and I'm reading about it. I was trying to find out which is the best between SHA256, Bcrypt and MD5 when it comes to hashing ...
0
votes
0answers
99 views

How is a birthday attack actually performed?

I thought I understood the birthday attack until I tried to actually implement it. Either I'm implementing it wrong, or there's something wrong with my interpretation of the resulting probabilities. ...
0
votes
0answers
42 views

How do I combine a salt and hash for John The Ripper? [duplicate]

I found a password hash *61A2BD98DAD2A09749B6FC77A9578609D32518DD I found a salt somewhere else. How do I combine these to feed into John the Ripper? When I run John on the hash (minus the *) John ...
1
vote
2answers
106 views

Best way to encrypt a username in a database?

In my database, I would like to encrypt every identifiable piece of information, including the username, such that people with access to the database cannot deduce the actual username (because it ...
0
votes
1answer
38 views

Are all fields of the PE certificate directory hashed during authenticode signing?

In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
4
votes
2answers
294 views

How does a zip file detect a correct password?

When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file. How does an encrypted ZIP detect when the user has given the correct ...
1
vote
2answers
108 views

How to crack a password given its hash and its possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256. I have the hashes available and I also have the possibilities in which the password can be. Some of these possibilities ...
-4
votes
2answers
134 views

How secure is my hashing algorithm? [duplicate]

This is probably the common question on stack exchange but I need to know is this really safe as it seems to be? //Password hashing stage 1 $a_password = sha1($a_password); $a_password = md5($...
1
vote
1answer
593 views

I know salt and hash(password + salt), how do I get hash(password)?

...If it's possible at all. By hash I mean md5, sha1, sha256. And how difficult is it? I mean, if it's possible mathematically, are there any tools around?
1
vote
2answers
197 views

Which hashing algorithm shoud I use for a safe file checksum?

For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them. To protect the integrity of the work I have done and to guarantee it has never ...
3
votes
1answer
49 views

Can I securely keep the user logged into my local application AND use the password as a decryption key?

I'm somewhat new to data encryption/safety, but I already read about basic concepts like hashing passwords, encrypting files, etc. If possible, please ELI5 - thanks in advance. Background: my ...
2
votes
3answers
158 views

Password-hash proofing SHA-3

I am in a situation where I need to harden a password hash, but not allowed to bring in any extra dependencies, so I am pretty much forced to do the one thing everyone seems to advise against - roll ...
0
votes
1answer
35 views

Password hashing on both client and server : what are the risks concerning hash composition (collisions and reversing)?

There are plenty of question addressing the "client / server : where to hash ?", but i have not found anything about my particular question : considering a server_salted_hash(client_salted_hash(...
2
votes
1answer
64 views

Hash password with bcrypt before encrypting document with openpgp

Hi all first time posting thanks for putting together this great community. I'm working on an extension to allow users to store encrypted documents on a server I host. I'd like to avoid having them ...
33
votes
3answers
7k views

What does “in-house hash function” mean?

In security news, I faced a new term related to hash functions: it is reported that the "in-house hash function" used in IOTA platform is broken (i.e. Curl-P hash function). You can find the complete ...
44
votes
12answers
15k views

Is it better to use an unsuitable hashing algorithm instead of none at all?

I have to store passwords on a system which doesn't offer any of the algorithms recommended for hashing passwords (e.g. bcrypt, scrypt or PBKDF2). Would it be better to use an unsuitable algorithm (e....
0
votes
3answers
167 views

Are hashes a reliable method of ensuring a file has not been tampered with?

Suppose I have a file and that I want to confirm that this file is the same as the original (IE: it has not been altered in any way) using hashing. If I were to use a hash function that has no known ...
3
votes
1answer
109 views

Difference in between salt and random padding in cryptography

I would like to know what is difference in between using salt and using "random padding" in cryptography. I am familiar with term salt when we use it with hashing. How does "random padding" differ ...
1
vote
0answers
93 views

Help figuring out this hash function [closed]

I have a tough nut to crack. I'm working on hashing passwords for our network switches (because the alternative is plain-text passwords...). For people who would care about this; it's a huawei switch. ...
26
votes
10answers
10k views

How to secure passwords over HTTP?

Say my password is abc. I want to send it to the server over HTTP. I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
54
votes
5answers
13k views

Is it bad practice to prefix my hash with the algorithm used?

Let's say I have a database with a bunch of users in it. This user database would typically have a hashed password per user. Would it be bad practice to prefix this hash with the hashing algorithm ...
0
votes
0answers
40 views

Derive random output from payload & encryption key and verify it without knowing the payload

I want to know if this type of hashing or encryption scheme exists. Let's say there is a master key : 'abcdefg' I want to encrypt the payload : '2018-11-08 22:11:02' The output : '...
1
vote
1answer
50 views

preimage resistance [duplicate]

I'm struggling to get a clear understanding of second preimage resistance and collision resistance. Research on the internet yielded the following definitions: Second pre-image resistance Given an ...
2
votes
4answers
144 views

Is an authenticated server seeing the plaintext password a serious problem?

Typically a server ends up observing the plaintext password sent by a user at some points (correct me if it is not). Assuming that there is a secure channel established and the data are confidential, ...
1
vote
0answers
31 views

Rotating session names vs a static session name with a rotating validation string

I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon ...
1
vote
1answer
51 views

How to support search of data under PCI-DSS?

Suppose that the data in question is a card PAN. According to PCI-DSS, you have to store it with extra security (encrypt it before storing in database and store the secret key elsewhere with more ...
0
votes
1answer
117 views

Bots trying to spoof encoded email links, but why?

I've setup an application for my client, that sends lists of job vacancies to subscribers every Monday morning. The emails use a custom link redirector service, to make the links email friendly, and ...
3
votes
3answers
129 views

Is it possible to use “cryptographic hash function” for “digital signature”?

I understand that a cryptographic hash function is a function that generates a fixed size random string for an arbitrary input. However, is it possible to use a cryptographic hash function for ...
0
votes
0answers
135 views

How to mask attack a sha256 hash with following information using hashcat?

I am hashcat newbie and I want to crack a hash :) The answer is 1-15 (unknown) characters and it may contain 'a-z' 'A-Z' '0-9' and '_' . (A Twitter username) How may I mask attack a hash with above ...
1
vote
2answers
120 views

Does a File's Checksum Change after it is Digitally Signed?

From my understanding, when you digitally sign a file, it changes that file's checksum because they are bundled together. Example of what I mean: file1.txt only contains the letter 'd' and the ...
0
votes
0answers
14 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
1
vote
4answers
223 views

Why should we protect access to password hashes?

Why should we protect the access to the password hashes? And under what conditions can this precaution be omitted?
1
vote
0answers
38 views

Increase password iterations?

Is it possible to strengthen the macOS login password by increasing the number of sha-512 iterations?
1
vote
1answer
43 views

Ensuring key integrity

I have encrypted AES key stored in the database with the encrypted data. AES key is encrypted with a key derived from the passphrase. I want to ensure the integrity of the stored AES key. Is the ...
1
vote
1answer
56 views

How do Field Programmable Gate Arrays (FPGAs) compare to Graphics Processing Units (GPUs); for cracking hashes?

As a general rule, GPUs are more effective than CPUs when it comes to performing acutely repetitive tasks, like iterating over lists and generating permutations of a set (i.e. exhausting dictionaries &...
2
votes
1answer
56 views

Proof of information having been created before it is released

I have been thinking about the following use-case: some institution wants to organize bets about an outcome that is of its own choosing. The timeline is as follows: The organization chooses the ...
0
votes
1answer
112 views

Both Ophcrack and ONTP&RE incorrectly show Windows 10 passwords as blank

I'm trying to crack a Windows 10 laptop that I myself set a password on a day or so ago. So far I've tried booting into Ophcrack 3.6 and ONTP&RE (Offline NT Password & Registry Editor) from ...