Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

Dynamic format used in John the Ripper jumbo way slower than MDXFind

I'm currently doing some research on a pretty huge list of hashes (approx. 2 millions) and thus I'd like to improve my cracking speed. The hash format is 12 rounds of SHA512(password + salt), which ...
2
votes
0answers
36 views

What can make unmounted volumes SHA512 hashes differ while mounted volumes content SHA512 hashes are identical?

I am trying to configure Raspberry Pi OS to be read-only. In theory, both / and /boot are read-only. That being said, I am experiencing a strange discrepancy and can’t figure out what is happening. I ...
20
votes
4answers
2k views

Do you rather trust a widely adopted algorithm or an underdog if they're cryptoanalytically on a level playingfield?

If it comes to the security a hashing or encryption algorithm provides, we never know the full story. There's that part that we (respectively the public research) understand and can reason about, but ...
1
vote
1answer
72 views

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
0
votes
1answer
28 views

How to sign multiple data sets with a single signature, so that it can be validated for single data set without requiring the rest of the data?

Let's say Alice has three secrets: SecretA, SecretB, SecretC Alice shows these three secrets to Bob and gets a single signature from him that signs all three secrets together. Something like Signature ...
0
votes
4answers
126 views

Why can't you use the same password for every site, if they are hashed on the site?

I've often heard people talking about not using the same password on every website. What's the deal if servers store passwords in a SHA hash instead of plain text? The most they can do is spam you ...
0
votes
1answer
52 views

dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?

I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt. I want to confirm some of my understandings: Salt is automatically generated by cyrptsetup with ...
2
votes
0answers
41 views

Why does firebase encrypt with password hashes instead of storing the hashes?

I am trying to migrate off of firebase, as in doing so, you can export the hashes of user passwords. Looking at their algorithm, they do not store password hashes, but rather, they use the first 32-...
0
votes
1answer
50 views

OpenSSL: how to get matching subject_hash from a CMS SignerInfo?

So OpenSSL can calculate a hash value for X509 certificates that uniquely identifies this certificate: https://www.openssl.org/docs/man1.0.2/man1/x509.html (argument -hash or -subject_hash) now, if I ...
1
vote
1answer
108 views

Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?

To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
0
votes
1answer
59 views

Sending and blocking emails from hashed and salted address ? (for GDPR)

I would like to send emails from a server, but also make them unable to trace for me as server owner or attackers. I want this for GDPR but also to protect people from abusers. Short info about ...
6
votes
1answer
144 views

For bcrypt why is JTR so much faster than hashcat?

To keep it short I've recently been learning about hashing and password hash cracking on TryHackMe. I was tasked to crack the following hash: $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V....
1
vote
1answer
59 views

Config file contains password hashes and signature keys

First, I am a beginner in IT security. I hope my question is not too dumb. I use a program that can show a live feed from a security camera. You can import a project file, that sets up user accounts ...
3
votes
2answers
92 views

Why should I go to SHA512withRSA signature for my Android apps?

I have an Android 11 device and many of my apps and system apps use MD5withRSA or SHA1withRSA as signature algorithm by default. Why should I take my apps SHA256withRSA or SHA512withRSA? Are there any ...
2
votes
1answer
177 views

John The Ripper Error: No password hashes loaded when cracking a zip file in kali linux

I was practicing bruteforce attacks using John The Ripper. I want to crack a zip file. I obtained the hash and stored it in a zip file but when I attempt to crack the zip file it is giving me an error ...
1
vote
1answer
69 views

Why the need to hardcode passwords? [closed]

Many IOT devices and routers manufacturers hardcode plaintext default passwords in their devices. Why don't they store the hashed password instead? For what functionality do they need the plaintext ...
1
vote
2answers
122 views

Why don't companies just tie the password to the user name?

One problem with passwords is that if they can be broken as follows: pick a random password hash it compare that hash to other known hashes This way, you have broken the password. Then if you can ...
0
votes
1answer
55 views

What is the relation between “signature_algorithms” handshake extension and TLS ciphersuite

I am learning TLS handshake and find client/serve will negotiate a cihpersuite during client/server hello. Usually, the last part of a ciphersuite is a hash algorithm, like SHA256 in ECDHE-ECDSA-...
0
votes
3answers
101 views

How to verify integrity of software when the download provider doesn't publish hashes?

I noticed that certain software does not provide hash anymore nowadays. E.g. Zoom https://zoom.us/download wolf@linux:~$ ls -lh zoom_amd64.deb -rw-rw-r-- 1 wolf wolf 44M Jan 1 00:00 zoom_amd64....
0
votes
1answer
59 views

How password_hash / password_verify can work with any arguments (PHP)

I already know how to use password_verify and password_hash functions, but I don't really understand how they work. When I use them I do something like that: $save_hash = password_hash( $password, ...
0
votes
1answer
42 views

How to identify this hashed text and if it encrypted using a key? [duplicate]

I have 2 hashes which I don't remember which type of encryption I used or if i used a secret key. can you help me identify these I will just give all details but not paste the whole hash here. hash1 ...
0
votes
0answers
24 views

How to assess security of Argon2 parameters [duplicate]

I would like to hash user password with Argon2id, then use this hash as ECDSA private key. I made some tests with Python and passlib.hash and found following parameters: memory: 32 MB iterations: 100 ...
2
votes
1answer
66 views

one-way hash with PhP onto MySQL database (NOT for password)

My users (researchers) will be storing where their website is on a mysql database on my server. Ideally I want to hash the locations so that when the researchers' participants submit their data to my ...
2
votes
1answer
98 views

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
8
votes
4answers
2k views

Alternatives for sending plaintext password while login

Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
2
votes
1answer
72 views

how message authentication code share keys?

How are secret keys shared between receiver and sender, especially when we want to have confidentiality that sender and receiver are using two keys, one for MAC algorithm and one for encryption and ...
0
votes
2answers
81 views

Private key Proof of Ownership [closed]

Given 2 entities, A and B: A has a public key( x ) and a private key( x* ). B has a A's public key hash( let's call it h(x) ). A has to prove ownership of x* to B. How could this be achieved, ...
1
vote
1answer
93 views

Is md5(data + key) secure if a proper hmac function isn't available?

I need to generate a MAC signature for data on a website, but it's in a HTML templating system where there's only a few functions available. The only hashing function available is md5. Ideally, I'd ...
0
votes
1answer
42 views

What do algorithms `128000` and `256000` do in `sha3sum`?

I wanted to try new sha3sum so I installed libdigest-sha3-perl on Debian 10. After reading man page I quickly realized that: sha3sum --algorithm 256 test.txt produces similar output to sha256sum and ...
0
votes
0answers
20 views

Time it will take to crack a password file? [duplicate]

I'm trying to answer a multiple-choice question which is the following: "Consider the security of a password file, which includes a 10 bit salt and all passwords are hashed, but known to consist ...
2
votes
2answers
84 views

Appropriate length and slow, unsalted cryptographic hash function for random codes?

Given the following situation: we have sensitive information and want to give a user access to it. At this point the user might not have interacted with our system yet. We generate a random code that ...
1
vote
0answers
46 views

Good use of libsodium?

I am looking to hash user passwords to store in a database that will likely reside on a user's intranet, so I am expecting the database to be classed as open and insecure. I am using libsodium 1.0.18 ...
0
votes
0answers
50 views

Running Responder outputs many hashes per user, how is this possible?

I am running Responder on Kali Linux within a client network using the following command sudo responder -I eth0 -w -r -d which is capturing many hashes in the environment. Responder is a LLMNR, NBT-...
1
vote
1answer
89 views

How to confirm the last entry of a linked hash list

We use a linked hash list for data integrity. Content is hashed (HMAC-SHA256) and stored in a block that itself is hashed and referenced in the next block: Simplified example: ... { id: "...
7
votes
1answer
1k views

Is MD5 hashing possible by divide and conquer algorithm

I would like to compute the MD5 hash of a file The file is uploaded to my webserver by my clients The file is uploaded in pieces (called chunks) The client also sends the md5 hash of the file so that ...
1
vote
2answers
53 views

Enpoint protection: How to search an organisation for hash value

As part of incident response to malicious code outbreak and given the hash value of the malicious artifact, I would like to search across the entire organization for this specific hash value. Do you ...
0
votes
1answer
32 views

Generating tokens via PRNG and Hashing

We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it Step 1: Generate a random number using a good a CSPRNG ...
1
vote
0answers
42 views

Hashing of password in banking mobile app

Do I have to hash passwords on the client side of a banking mobile app since i am using a SSL network to send the password to the server end for hashing. Can the password be intercepted before ...
2
votes
1answer
76 views

Can a truncated crypto hash of a truncated crypto hash help harden a resource against attacks?

In a project of mine, I have two fields which I need to use for storing a cryptographic signature (hash) of a file, but I can only use 112 bits in total, spread as 16+12 hex chars in those two fields. ...
0
votes
0answers
45 views

Storing account data on device

I am trying to make an app that allows the user to connect to a service through an API I am also developing. All passwords and account data are securely stored on the server. However, how should I ...
0
votes
1answer
51 views

Is client-side hashing secure during password creation when verification is still done server-side?

Trying to do this to distribute the work of creating a lot of users in which their passwords are hashed. This will cause the server to do a very large amount of work. The idea is this: (Assume ...
0
votes
0answers
124 views

John The Ripper: “no password hashes loaded (see FAQ)”

I'm trying to use John The Ripper to crack a private ssh key I generated with ssh-keygen. I think I've seen and read every guide under the sun, and I've managed to get as far as a string john the ...
0
votes
1answer
97 views

How is the bcrypt algorithm decrypted? [duplicate]

I have a ton of hashed texts and their decrypted or de-hashed forms (I don't know which term is suitable in this case) via bcrypt. The thing I want to learn is how they are decrypted. For example, the ...
0
votes
1answer
133 views

How does john the ripper crack hashes using wordlists?

How does John The Ripper work when trying to crack passphrase of a private ssh key? As in what steps are involved when it tries to do so? What's the role of ssh2john in the whole process?
3
votes
1answer
83 views

Fail to understand how hash length extension might work in real application

I'm trying to understand how the hash length extension might work on real web applications using a hash for MAC. Especially what I don't get is, how the application considers the evil forged hash ...
0
votes
0answers
209 views

crack MySQL323 hash

I'm trying to crack a MySQL323 hash and I'm unable to get it done. I was able to confirm tye hash type: I came across https://www.tobtu.com/mysql323.php. I can run it as "mysql323 32.exe" [...
21
votes
3answers
4k views

Does complexity of salt in password hashing matter?

I have no cyber security knowledge whatsoever, and am trying to safely store passwords in a database. I understood I need to use salt, to avoid rainbow table attacks and to make sure two users with ...
0
votes
0answers
19 views

Found out that a paid VPN service emails plaintext passwords [duplicate]

I recently found out that a VPN service does not hash their customer passwords and I need professional insight on how to deal with this. Here's how I found out: Bought a subscription on the wrong ...
0
votes
0answers
80 views

What is the point of hashing an API key?

Within my API backend i have a unique KeySalt for every API Key public string Key { get; set; } public byte[] KeySalt { get; set; } public string KeyHash { get; set; } When the user creates a new ...
0
votes
2answers
150 views

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here, the hashsum are made part ...

1
2 3 4 5
42