Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
0answers
63 views

How to identify encryption type [closed]

I want to know how to identify a cyphertext. For example, let's say I have the following ciphertext: Encrypted link: {"link":"...
-3
votes
2answers
198 views

When will hashing no longer be useable? [closed]

I'm curious about hashing, because normal hashing is static, it means that a string that gets hashed will always be the same (except for using salt). Because of that situation, there are many websites ...
1
vote
1answer
119 views

What is the plaintext password of 'hash part 1' in the shadow file?

on immersivelabs lab Password Hashes II https://dca.immersivelabs.online/labs/password-hashes-ii/ there is a question: What is the plaintext password of 'hash part 1' in the shadow file? shadow.txt ...
0
votes
1answer
83 views

Is this Wikipedia article about SCRAM wrong?

At my Company, we put a honeypot in our network and it raised us the Lansweeper SSH password used to connect to the scanned assets (and it is reusable over many boxes...). So it is a way for an ...
20
votes
3answers
5k views

What's a “safe” URL shortening algorithm?

The situation: Currently, we are sending out emails and SMS to our users, which include a link to a form that each user has to fill out on a regular basis (an "eDiary"). As we need to be ...
14
votes
7answers
2k views

Timing attacks in password hash comparisons

I had a discussion with a friend today about his password hash comparison. I argued that you can't return false on the first hash mismatch you have and I sent him a link to an article about a Java ...
2
votes
3answers
116 views

Cryptographically prove open sourced source code of server

I want to prove that the source code I am using is the same as the open-sourced version, which is publicly available. My idea was to publish a hash of the open-sourced version and compare it to the ...
0
votes
0answers
8 views

What's the difference between digest algorithm and signing algorithm? [migrated]

I'm reading rfc5652, there are different references of the two algorithm identifiers. For example in this ASN.1 structure : https://tools.ietf.org/html/rfc5652#section-5.3 When using RSA for signing; ...
1
vote
2answers
168 views

Encrypting a password with its own hash

I just found out that an e-commerce platform (similar to Shopify) I was planning on using allows me to see my password. I know I can't assume anything and I should (probably) just run away from it, ...
0
votes
1answer
67 views

Main Reasons for GPG over hashing for verification

I have recently been introduced to GPG signing as a better way of verifying data than hashing. It was described that if you posted the hash of the file, someone could hack your website, alter the hash ...
0
votes
0answers
62 views

how to document and check apt inrelease files? are there blockchain records for that?

apt InRelease files update like twice every day, in ubuntu repositories and their mirrors. similarly in ubuntu and debian based distros, and other apt repositories. these files are small text files ...
8
votes
2answers
2k views

Should http basic auth passwords be stored hashed serverside?

HTTP basic auth sends credentials un-hashed and unencrypted over the wire, relying on TLS for confidentiality in transit. However, should the password be stored hashed using a standard KDF in the ...
0
votes
2answers
79 views

Is adding encryption before hashing more secure?

One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value. Does encrypting the password || salt then ...
46
votes
2answers
11k views

Magic hash attack in JavaScript

In PHP a magic hash attack happens when loose type comparisons cause completely different values to be evaluated as equal, causing a password "match" without actually knowing the password. ...
0
votes
1answer
48 views

Locking accounts using the same strong hash in the database

A website has some bruteforce prevention for logins, and I need to turn that off because it's buggy and it's causing problems. It will stay turned off, probably forever, because there are no plans to ...
0
votes
1answer
61 views

Modifying a SHA256 system to be ASIC resistant

I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant. ...
2
votes
1answer
91 views

How likely is to have a hash function output flip a bit?

I was looking into this code base (https://github.com/vstoykovbg/doubleslow) and the following phrase caught my attention: DANGER of catastrophic data loss! One bit flip (due to cosmic rays for ...
0
votes
1answer
55 views

Avoid strong password hashing functions aiding a DDoS attempt on oneself [duplicate]

While reading this question, it got me to thinking. Let's say an attacker has some way to make all of their login attempts appear legitimate - enough IP addresses to never reuse them, different valid ...
0
votes
2answers
49 views

What can you do to make a hashed token database retrievable at a later date?

I have a table for single use tokens, and one of the columns is a token_digest which contains a bcrypt hash of the access token. Since the token_digest is a salted and hashed version of the plaintext ...
1
vote
2answers
163 views

What's the difference between these MD5 hashes?

What's the difference between this format: Hash found: admin:$1$$oLN1UCc1Y3T30QkMcKMSx0 and the following: 5f4dcc3b5aa765d61d8327deb882cf99 And also, How to turn the first hash format into the ...
2
votes
0answers
136 views

Recovered a 7z password with hashcat, but it's not the right one

I am trying to recover a 7z file, but have forgotten the password. It's completely AES-256 encrypted (i.e. not even the filenames are available). Steps: Generated hash file with 7z2hashcat.pl Ran a ...
0
votes
2answers
87 views

Is it unsafe to have some users with passwords and some without?

I'm working on an app where some accounts use passwordless authentication by email (using magic links) and some require a password to login. Is it okay to represent this rule in the account table by ...
0
votes
0answers
55 views

Can a secure key-exchange algorithm replace hashing for password authentication?

Over the weekend I was thinking about the problem of scaling various web services. One common practice to scale authorization is to use cryptographically signed tokens. This way when a request comes ...
0
votes
3answers
85 views

How does memory-hard hashing passwords protect against brute force attacks?

I have a background in web app development and I'm trying to up my security game but there are some things that I find confusing. Like how does memory-hard hashed passwords protect against brute force ...
0
votes
1answer
48 views

Certificate Signed Using Weak Hashing Algorithm impact on a workstation

I did a vulnerability scan on some of our company workstations. These are workstations used by employees (dev, HR, accounting, etc.) to do their job. One of the common result I found is SSL/TLS ...
1
vote
1answer
102 views

How to apply custom filters for John The Ripper when cracking RAR3 archive password?

My problem is that I'm trying to crack RAR file with is encrypted with RAR3 encryption. Decided to try with John The Ripper. Here are clues I have from my friend. Max password length is 8 Only ...
0
votes
2answers
89 views

How is CSR encrypted?

Using openssl to generate a CSR: > openssl req -newkey rsa:2048 -nodes -keyout key -out mycsr.csr It outputs the mycsr.csr file along with the key file. The content of mycsr.csr: -----BEGIN ...
0
votes
0answers
40 views

Is it safe to use HMAC to create an API key?

I am planning to create an API key using the user's password as message and a random number assigned to that user in my database as key (or vice-versa). I will then store the hash of that API key in ...
14
votes
13answers
9k views

Couldn't we create a string that produces the same hash as another string in SHA-256?

Let's say we have a separate hashing algorithm called s2 and it would convert Hello into dug84nd8. If we could take the algorithm and just reverse engineer it to generate a string like 8GN492MD that ...
0
votes
2answers
109 views

Encrypting a salted password hash with RSA before storing in a database [duplicate]

Why is it a bad idea to encrypt a salted password hash with RSA (or maybe other public-key algorithm) before storing it?
0
votes
1answer
106 views

Encrypting salted password hash before storing in the database

I have read here and here, that instead of using pepper, it is better to encrypt hashed/salted passwords before storing in the database. Especially with Java, as there's no library for salt/pepper, ...
0
votes
1answer
70 views

Is using Argon2 with a public random on client side a good idea to protect passwords in transit?

Not sure if things belongs in Crypto SE or here but anyway: I'm building an app and I'm trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have. In ...
1
vote
1answer
119 views

Why are salted hashes better than just hashing? [duplicate]

I have recently read an article about storing passwords safely and I have a few misunderstandings. I found out 4 ways of storing users' passwords: Just keep them in plain text Keep passwords in plain ...
0
votes
1answer
29 views

Way to validate a parent/child relation [closed]

I have a rest endpoint for example /user/{userId}/message/{messageId} I have the possibility to create both ID's as I want. How can I create messageId and know the message is belong to this user, ...
0
votes
1answer
88 views

Is it possible to reverse a sha256 hashed value if we know part of the input value?

I'm a total noob, so please help me out. Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text? Ex: xxxxxx + j4l58jl6j4l6j4 = ...
0
votes
0answers
59 views

Does hashing client-side increase attack surface (assuming TLS and serverside salt+hash)? [duplicate]

This question asks whether one should hash on the client or the server. I want to know if there is any reason, aside from having to maybe handle one extra hashing library (if it's not already in your ...
4
votes
1answer
184 views

How does a company check the password received from your phone keypad during a call? [duplicate]

I had to call customer service recently regarding my 401(k) and robo call in the beginning asked me to enter my social security number using the keypad followed by a # and then asked for my account ...
0
votes
1answer
244 views

John The Ripper and PBKDF2-HMAC-SHA1

I am trying to hash a list of passwords with PBKDF2-HMAC-SHA1 and then crack them using John. However, John does not recognise the hashes and I get a No Hashes Found error. It works with SHA256, but I ...
0
votes
0answers
55 views

What's the term for a hash sent early and plain text revealed later?

I think there is a known pattern where you post the hash of a document, e.g. on Twitter, in order to have its time registered. You could then later publish the document and have it accredited for the ...
0
votes
0answers
15 views

Detect what algorithm is used [duplicate]

I wanted to asked how can i identify what algorithm was used. This is my code:...
0
votes
3answers
69 views

Associate API key with user

I am creating a public API that will require API key authentication. When a user wants to register a new API key, they send a request to one of our endpoints with a list of permissions they want. We ...
44
votes
3answers
7k views

Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords? [duplicate]

I have a large database where passwords are stored as strtolower(hex(md5(pass))) (which is a bad way to store passwords, prone to rainbow tables, cheap to dictionary attack, no salt, etc.), and I'm ...
7
votes
2answers
2k views

If hashing should occur server-side, how do you protect the plaintext in transit?

I've been working on a full stack project recently for my own amusement and would like to add authentication services to this project, but want to make sure I'm doing it the right way. And before ...
2
votes
1answer
150 views

Does anyone know what this encoding format for passwords is? I think it is a decimal array but I can't seem to convert it

During a penetration test, I ran across a server that was storing passwords in its database in what seems to be a binary array of sorts: password_table 1,12,12,12,122,21,13,00,00,00,000 11,112,443,12,...
0
votes
2answers
231 views

Is it possible to brute-force the original message of SHA-256 given the size of original string?

Given the SHA-256 hash, the size and the encoding of the original string, is it possible to recover the string via brute force? How many string of a given size will result in the same hash?
11
votes
7answers
3k views

Does client side hashing reduce insider risk?

One of the companies I worked for used client-side hashing to minimize risk when logging the password in the server logs. Can this be a good reason to implement client-side hashing?
0
votes
0answers
44 views

Why developers put the installer/executable and the file checksum on the same server? [duplicate]

On https://exiftool.org/ , there is a link to https://exiftool.org/exiftool-12.01.zip and https://exiftool.org/checksums.txt . Both the ZIP archive and the checksum hash are hosted on the same machine....
0
votes
3answers
92 views

Can we check fingerprint with photos?

Let's assume an insecure communication channel. Alice makes a public key (we assume is PGP, but any asymmetric crypto could be used unless it doesn't have fingerprints for checking) and sends it to ...
0
votes
2answers
104 views

Sign records in a database [closed]

I have a table in my database where I store records to be processed later (basically orders that need to be invoiced or something similar, but this is not the important part). Since this software runs ...
3
votes
2answers
102 views

Is this method of 32 char hash generation secure enough for online-based attacks?

A fellow developer and I have been having a discussion about how vulnerable a few different methods of developing a hash are, and I've come here to see if smarter people than I (us?) can shed some ...

1
2 3 4 5
41