Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

1
vote
1answer
70 views

Slow Hashing Without a Salt?

I'm trying to design a security scheme that involves a shared secret but isn't a traditional account password situation. The server would store a set of "keys", each of which has a blob of data ...
0
votes
0answers
63 views

How many unique MD5 hash values are there really? [duplicate]

The hashed value created by the MD5 hashing algorithm contains 32 chars, each of which contains 1 of 16 possible values. Simple math demonstrates that this could result in 16^32 number of ...
0
votes
1answer
35 views

Using AES encryption to generate MAC (and provide authentication/integrity)

Ignoring that there are far better and more standard approaches to providing authentication and integrity guarantees, what (if any) weaknesses would a system as outlined below that relies on AES (AES/...
0
votes
0answers
27 views

Extracting clear text password using Mimikatz and DCSync

I have a AD domain and the passwords are stored using the reversible encryption. I am using the Mimikatz tool with lsadump::dcsync /domain:xxx.com /user:<name> to retrieve the clear text ...
0
votes
0answers
19 views

Decrypting a simple string [on hold]

Code: 686cdac2f10fe9edb6c45726d3590128 Simple string provided by a game I play. Only tips I was given was "search on google". It's been hours and I've got like 15 different strings like this. What ...
1
vote
1answer
31 views

Securely Download lubuntu from Non-Ubuntu System

The recommended way to find out which public key you need to verify the Ubuntu hashes is to attempt to check a signature of the hash file (both of which were downloaded in the clear). This produces an ...
0
votes
1answer
26 views

How can hash keys of downloadable binaries be useful if a website has been compromised? [duplicate]

Sometimes a website that has some binaries to download, also presents their hash keys, so that a user can verify the integrity of the binary. I suppose this is mainly for security reasons, not to ...
1
vote
2answers
48 views

Confusion about the software and also the digital signature getting modified

I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted ...
1
vote
1answer
55 views

Best practices to protect public/private SSH key pair in web interface?

I've got a dilemma here: I'm working on a system that will connect to remote linux servers for monitoring and automating some processes. Since user+pass is insecure for obvious reasons and public/...
7
votes
2answers
1k views

What could an attacker do if they gained access to PBKDF2 hashes?

This is regarding a web application where a user has to login with their personal email as the ID, and a password they have chosen personally. If an attacker somehow gained access to a credential ...
6
votes
0answers
128 views

In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?

There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
1
vote
1answer
115 views

How to increase the time for an offline password attack

I am trying to answer a CASP exam practice question. Could someone comment on the options below regarding the logic behind each item? Where is the logical error behind each statement? A Storage-...
0
votes
2answers
144 views

Is it possible to crack Joomla hash password?

I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash Joomla password which is (5aa154999c111bf7f33a1a3cadba5847) and I don't know the salt. is there any way to crack ...
-1
votes
0answers
38 views

What password hashing algorithm should I use for my site? [duplicate]

I am working on an e-commerce website and I need to hash passwords. I know there are lot of algorithms like SHA-1, Argon2, PBKDF2, scrypt, etc to choose from but which is best suitable for my site?
0
votes
2answers
46 views

Generating multi-word passphrases from a wordlist

As part of pentesting NT hashes where the underlying passwords are minimum 16 characters of length, I have created a wordlist of common words, sports teams, movies, names, years etc. - inspired by the ...
0
votes
0answers
17 views

Add a secret key to Bcrypt ? [duplicate]

I'm a newbie with Bcrypt, after reading their npm presentation, I have seen that they don't provide key secrete feature. I wonder if it's possible to create a key secrete for Bcrypt as we would make ...
1
vote
1answer
45 views

Is RIPv2 MD5 authentication insecure?

While performing a vulnerability assessment, I stumbled upon RIPv1 poisoning routing table attacks. The recommendation is to use RIPv2 with MD5 authentication. The idea is that the routes need to be ...
1
vote
1answer
43 views

hashcat specific brute force

Is this scenario possible: I know the first three letters of the password (exact), i know the password is between 10-14 characters, i know the rest of the characters are "b,t,p,1,3,6,7" which can be ...
0
votes
2answers
84 views

Most efficient way to crack a NTLM hash

I've been given a non-salted NTLM hash and a week worth of time to find the password it hides. I have also been told the password length is 11 chars, and that it is a Windows 10 user password. I'm ...
0
votes
1answer
141 views

How to save one password for all users without hashing?

I am working on a plugin for site A that logs in to an external site B. The plugin needs to store the password to site B, but I can't use hashing because I need to send the login information to B. I ...
0
votes
1answer
42 views

Implementation of PMKID computing function

I am trying to implement a function, let's say in Python to compute Pairwise Master Key Identifier (PMKID) after reading the previously discovered bug in WPA2. Googling gave me this logical statement: ...
1
vote
0answers
54 views

Javascript asymmetric password-based encryption

I want to code a web app that allows 2 users to send encrypted messages to each other, and I want to maximize security, so I want to minimize the amount of trust I put in my cloud provider (both the ...
1
vote
1answer
63 views

Understanding ANSI/AAMVA encoded data (pdf417 data matrix) on back of NYS ID card

Background I am developing an Android application for work which runs on a Zebra TC51 bar code scanner, which I have been playing around with.. I scanned my NYS drivers license and inspected the ...
0
votes
1answer
54 views

When would one use a password hash instead of a KDF?

From what I'm reading, for storing passwords it is recommended to use a KDF (like Bcrypt). If it is more secure to use a KDF for handling passwords, when would you use a password hash instead?
1
vote
2answers
71 views

Why would a phishing blacklist be hashed?

I was planning to comment on the question at Finding phishing sites to certain domain and suggest searching Google's blacklist for keywords or substrings of a domain name in question. But then I ...
7
votes
5answers
279 views

Do hashes contain any of the original file’s data?

I am not a computer scientist, but would like to understand hashes such as SHA-256 more. Am I right in believing that a hash is simply a statement that a file produced a specific output (the hash), ...
0
votes
1answer
52 views

Crack Hashed Byte Array? [closed]

I know it would take forever to crack a simple hashed byte array, though for learning sake I was wondering whether it is possible to crack a hashed byte array? And if so, any suggestions how to do ...
0
votes
2answers
176 views

Can I throw away a private key and use the public key like a hash function?

Yes yes I know "don't invent your own protocols unless you're an expert". No need to yell at me I just want to know if there's a flaw in this idea and if not has anyone done it before. The motivation ...
1
vote
1answer
94 views

Hash a secret API key with a random salt instead of sending sending it alone in REST API

Say, I have an internal https API endpoint used only by me being the admin. In each each request I send a secret API key for authentication. And I'm fine with this solution. curl -x PUT ....... -...
2
votes
4answers
134 views

How to ensure file integrity cryptographically?

Problem: I have a collection of files (source code for example) whose integrity has to be ensured. I don’t care if the files are corrupted (I can easily multiple backups). I just want to make sure ...
0
votes
1answer
69 views

Proper way to verify keycard integrity

I have thought about building an electronic door locking system. Would the following mechanism be secure at all to prevent tampering plain text information on card? hash private system key together ...
1
vote
3answers
245 views

Is it possible to crack any SHA1 hashed password

I'm trying to understand how easy it is to crack a SHA1 hashed password. I have a training database giving hundreds of password hashed. I have tried to use some online tools to crack them and I have ...
1
vote
0answers
86 views

How do I examine a fresh Windows 10 installation

I suspect an unauthorized modification has been applied to a fresh new installation of Win 10 x64 and/or a PC running it by a person who knows me personally with the purpose of tracking my activity ...
3
votes
4answers
961 views

Securing hashes of short enumerated values

The system manages and stores sensitive data of short strings. Because the sensitive data is of an enumerated type with limited set of well known values, the attacker could easily iterate all the ...
-5
votes
1answer
118 views

Encryption problem? [duplicate]

what type of encryption is this? qQzsfohbirnu5VGUG8gN92iWYRzIAIgUcZfGHyqDqy1HQKGoc1i0CsLkRci71awepmZLTbkBFo30hrMeAWjWUer7lZ3Yv8L6vsuH/sLtaN68zPWIl/7i6y28M+uIhoVOLTqTi3/...
-1
votes
1answer
102 views

How to securely generate and store the salting for password hash? [duplicate]

Assume a client authenticates using the password, which includes hashing and salting. The hash values are stored in a remote database server. Questions: For the hash values stored in the database ...
3
votes
2answers
298 views

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Maybe I have been negligent towards the verification of software I download over the Internet, but I (or anybody I ever met) have never tried to verify the checksum of the contents I download. And ...
1
vote
1answer
58 views

What function is used to generate client random in TLS

I've been learning TLS. During the Client-Server Hello their random values are shared. The client generates a 28 byte random and combine it with 4 bytes of epoch time to generate a 32 byte random ...
35
votes
7answers
11k views

What are the security risks of logging the hash of rejected passwords?

According to Is it common practice to log rejected passwords?, I know logging rejected plain text password is a bad idea, but how about if I store the hashed form of rejected passwords? I want to have ...
0
votes
1answer
153 views

Calculating Entropy using md5sum, sha256sum etc

We can calculate the Entropy S of a string simply like this: S = L * log_2(N) Where L stands for used characters in the string And N for every possible character Example: We want to calculate the ...
0
votes
1answer
158 views

Which hashcat hash mode is closest to that used by BitLocker?

I'm trying to get a hypothetical benchmark for the BitLocker hash mode if Hashcat would support it. Which (-m) mode is closest to BitLocker's latest/default algorithm? From Google searches I learned ...
0
votes
1answer
89 views

Generating salt for hash that occurs on server and client

Let's say I have an API call which is supposed to check if email address exists in the DB, without transmitting the actual email address. For that purpose, I've decided to store SHA256 hash of the ...
14
votes
5answers
7k views

How many rounds of hashing is enough for a password manager?

I'm currently writing my own little password manager that stores the key in a SHA256 hash, with salt. I create the hash by doing the following: def sha256_rounds(raw, rounds=100001): obj = ...
0
votes
0answers
33 views

Why do we need to hash passwords? [duplicate]

I understand that it's to protect the user credentials but my question is, If the hacker managed to get access to our database, what difference would it make? Let's give an example with facebook for ...
0
votes
0answers
20 views

Can klist be used to detect expiry dates for forged kerberos tickets?

I have observed that klist is used to list locally cached kerberos tickets. For golden tickets with indefinite expiry dates (say ~10 years), is it possible to list all the tickets submitted to a ...
2
votes
1answer
29 views

Is ssdeep FP-prone or FN-prone?

A bloom filter can incur FPs (False-positives) but will never incur an FN (False negatives). If the ssdeep value of two files are pretty close to each other, is it guaranteed that the file contents ...
0
votes
0answers
46 views

John the Ripper, mask and rules [duplicate]

I have obtained a hash for a password that I know is 10 characters and contains lowercase, uppercase and numbers. No special chars. I have created the following incremental mode: [Incremental:myown] ...
9
votes
3answers
512 views

How could our passwords be cracked so easily?

We are saving password in a database using PHP: return hash('sha256', PASSWORD_SALT . $password); Recently a (fortunately) good hacker SQL-injected us and cracked some passwords including the admin ...
3
votes
3answers
123 views

Can one find the value of a “constant salt” if they can set the password and get the hash?

Saying we have an oracle that an attacker can use as many time as they want. The attacker can send a non-empty password to this Oracle. The Oracle hashes the password using sha256(password + pepper), ...
1
vote
0answers
110 views

Cracking Salted Peoplesoft Hashes

So I felt the saga of my last post was getting too long (linked here: Unknown round length makes hash uncrackable?) so I would create a new one addressing the current problem as it stands. My new ...