Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
1answer
20 views

What is the relation between “signature_algorithms” handshake extension and TLS ciphersuite

I am learning TLS handshake and find client/serve will negotiate a cihpersuite during client/server hello. Usually, the last part of a ciphersuite is a hash algorithm, like SHA256 in ECDHE-ECDSA-...
0
votes
3answers
83 views

How to verify integrity of software when the download provider doesn't publish hashes?

I noticed that certain software does not provide hash anymore nowadays. E.g. Zoom https://zoom.us/download wolf@linux:~$ ls -lh zoom_amd64.deb -rw-rw-r-- 1 wolf wolf 44M Jan 1 00:00 zoom_amd64....
0
votes
0answers
57 views

MD5 Hex to Base64 String [migrated]

When I generate an MD5 hash with a plain-text (password), I get: $echo -n "password" | openssl dgst -md5 -binary | openssl enc -base64 X03MO1qnZdYdgyfeuILPmQ== This works fine if I knew ...
0
votes
1answer
50 views

How password_hash / password_verify can work with any arguments (PHP)

I already know how to use password_verify and password_hash functions, but I don't really understand how they work. When I use them I do something like that: $save_hash = password_hash( $password, ...
0
votes
1answer
38 views

How to identify this hashed text and if it encrypted using a key? [duplicate]

I have 2 hashes which I don't remember which type of encryption I used or if i used a secret key. can you help me identify these I will just give all details but not paste the whole hash here. hash1 ...
1
vote
0answers
52 views

Which config files in a linux install contain passwords or other secrets? [closed]

I'm trying to build a list of configuration files that store secrets in Linux. By secrets I mean files that contains passwords, database string connection, hashes etc. The most notable example is, of ...
0
votes
0answers
24 views

How to assess security of Argon2 parameters [duplicate]

I would like to hash user password with Argon2id, then use this hash as ECDSA private key. I made some tests with Python and passlib.hash and found following parameters: memory: 32 MB iterations: 100 ...
2
votes
1answer
63 views

one-way hash with PhP onto MySQL database (NOT for password)

My users (researchers) will be storing where their website is on a mysql database on my server. Ideally I want to hash the locations so that when the researchers' participants submit their data to my ...
2
votes
1answer
93 views

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
8
votes
4answers
2k views

Alternatives for sending plaintext password while login

Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
2
votes
1answer
64 views

how message authentication code share keys?

How are secret keys shared between receiver and sender, especially when we want to have confidentiality that sender and receiver are using two keys, one for MAC algorithm and one for encryption and ...
1
vote
2answers
76 views

Private key Proof of Ownership [closed]

Given 2 entities, A and B: A has a public key( x ) and a private key( x* ). B has a A's public key hash( let's call it h(x) ). A has to prove ownership of x* to B. How could this be achieved, ...
1
vote
1answer
88 views

Is md5(data + key) secure if a proper hmac function isn't available?

I need to generate a MAC signature for data on a website, but it's in a HTML templating system where there's only a few functions available. The only hashing function available is md5. Ideally, I'd ...
0
votes
1answer
36 views

What do algorithms `128000` and `256000` do in `sha3sum`?

I wanted to try new sha3sum so I installed libdigest-sha3-perl on Debian 10. After reading man page I quickly realized that: sha3sum --algorithm 256 test.txt produces similar output to sha256sum and ...
0
votes
0answers
18 views

Time it will take to crack a password file? [duplicate]

I'm trying to answer a multiple-choice question which is the following: "Consider the security of a password file, which includes a 10 bit salt and all passwords are hashed, but known to consist ...
2
votes
2answers
80 views

Appropriate length and slow, unsalted cryptographic hash function for random codes?

Given the following situation: we have sensitive information and want to give a user access to it. At this point the user might not have interacted with our system yet. We generate a random code that ...
1
vote
0answers
43 views

Good use of libsodium?

I am looking to hash user passwords to store in a database that will likely reside on a user's intranet, so I am expecting the database to be classed as open and insecure. I am using libsodium 1.0.18 ...
0
votes
0answers
48 views

Running Responder outputs many hashes per user, how is this possible?

I am running Responder on Kali Linux within a client network using the following command sudo responder -I eth0 -w -r -d which is capturing many hashes in the environment. Responder is a LLMNR, NBT-...
1
vote
1answer
86 views

How to confirm the last entry of a linked hash list

We use a linked hash list for data integrity. Content is hashed (HMAC-SHA256) and stored in a block that itself is hashed and referenced in the next block: Simplified example: ... { id: "...
7
votes
1answer
1k views

Is MD5 hashing possible by divide and conquer algorithm

I would like to compute the MD5 hash of a file The file is uploaded to my webserver by my clients The file is uploaded in pieces (called chunks) The client also sends the md5 hash of the file so that ...
1
vote
2answers
48 views

Enpoint protection: How to search an organisation for hash value

As part of incident response to malicious code outbreak and given the hash value of the malicious artifact, I would like to search across the entire organization for this specific hash value. Do you ...
0
votes
1answer
30 views

Generating tokens via PRNG and Hashing

We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it Step 1: Generate a random number using a good a CSPRNG ...
1
vote
0answers
41 views

Hashing of password in banking mobile app

Do I have to hash passwords on the client side of a banking mobile app since i am using a SSL network to send the password to the server end for hashing. Can the password be intercepted before ...
2
votes
1answer
73 views

Can a truncated crypto hash of a truncated crypto hash help harden a resource against attacks?

In a project of mine, I have two fields which I need to use for storing a cryptographic signature (hash) of a file, but I can only use 112 bits in total, spread as 16+12 hex chars in those two fields. ...
0
votes
0answers
42 views

Storing account data on device

I am trying to make an app that allows the user to connect to a service through an API I am also developing. All passwords and account data are securely stored on the server. However, how should I ...
0
votes
1answer
50 views

Is client-side hashing secure during password creation when verification is still done server-side?

Trying to do this to distribute the work of creating a lot of users in which their passwords are hashed. This will cause the server to do a very large amount of work. The idea is this: (Assume ...
0
votes
0answers
91 views

John The Ripper: “no password hashes loaded (see FAQ)”

I'm trying to use John The Ripper to crack a private ssh key I generated with ssh-keygen. I think I've seen and read every guide under the sun, and I've managed to get as far as a string john the ...
0
votes
1answer
84 views

How is the bcrypt algorithm decrypted? [duplicate]

I have a ton of hashed texts and their decrypted or de-hashed forms (I don't know which term is suitable in this case) via bcrypt. The thing I want to learn is how they are decrypted. For example, the ...
0
votes
1answer
123 views

How does john the ripper crack hashes using wordlists?

How does John The Ripper work when trying to crack passphrase of a private ssh key? As in what steps are involved when it tries to do so? What's the role of ssh2john in the whole process?
3
votes
1answer
81 views

Fail to understand how hash length extension might work in real application

I'm trying to understand how the hash length extension might work on real web applications using a hash for MAC. Especially what I don't get is, how the application considers the evil forged hash ...
0
votes
0answers
150 views

crack MySQL323 hash

I'm trying to crack a MySQL323 hash and I'm unable to get it done. I was able to confirm tye hash type: I came across https://www.tobtu.com/mysql323.php. I can run it as "mysql323 32.exe" [...
21
votes
3answers
4k views

Does complexity of salt in password hashing matter?

I have no cyber security knowledge whatsoever, and am trying to safely store passwords in a database. I understood I need to use salt, to avoid rainbow table attacks and to make sure two users with ...
0
votes
0answers
19 views

Found out that a paid VPN service emails plaintext passwords [duplicate]

I recently found out that a VPN service does not hash their customer passwords and I need professional insight on how to deal with this. Here's how I found out: Bought a subscription on the wrong ...
0
votes
0answers
78 views

What is the point of hashing an API key?

Within my API backend i have a unique KeySalt for every API Key public string Key { get; set; } public byte[] KeySalt { get; set; } public string KeyHash { get; set; } When the user creates a new ...
0
votes
2answers
134 views

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here, the hashsum are made part ...
2
votes
2answers
122 views

Is using PBKDF2 good protection against brute-force attacks on web application login pages?

We've recently had a penetration test for one of our applications. The Penetration Testing company identified that our application lacks protections against brute-force attacks on the login page. Ref: ...
0
votes
0answers
56 views

Is caching the credentials hash and auth result secure?

I have an API that is handling a lot of volume and is using Basic authorization. This is causing me some performance issues and I'd like to move to token based auth but for various reasons, including ...
2
votes
1answer
67 views

Password salting vs. length extension attacks

I read that when salting passwords, it is advised to use a h(pwd||salt) construction instead of h(salt||pwd), the latter being vulnerable to a length extension attack. What are possible scenarios in ...
0
votes
0answers
46 views

Discover AD accounts with LM Hashes

During a recent security audit, we found that a handful of accounts still have credentials identified as stored in LM hash format. For us, these were ancient service accounts and the like - easy ...
-3
votes
2answers
222 views

When will hashing no longer be useable? [closed]

I'm curious about hashing, because normal hashing is static, it means that a string that gets hashed will always be the same (except for using salt). Because of that situation, there are many websites ...
0
votes
1answer
438 views

What is the plaintext password of 'hash part 1' in the shadow file?

on immersivelabs lab Password Hashes II https://dca.immersivelabs.online/labs/password-hashes-ii/ there is a question: What is the plaintext password of 'hash part 1' in the shadow file? shadow.txt ...
0
votes
1answer
88 views

Is this Wikipedia article about SCRAM wrong?

At my Company, we put a honeypot in our network and it raised us the Lansweeper SSH password used to connect to the scanned assets (and it is reusable over many boxes...). So it is a way for an ...
22
votes
3answers
6k views

What's a “safe” URL shortening algorithm?

The situation: Currently, we are sending out emails and SMS to our users, which include a link to a form that each user has to fill out on a regular basis (an "eDiary"). As we need to be ...
14
votes
7answers
3k views

Timing attacks in password hash comparisons

I had a discussion with a friend today about his password hash comparison. I argued that you can't return false on the first hash mismatch you have and I sent him a link to an article about a Java ...
2
votes
3answers
125 views

Cryptographically prove open sourced source code of server

I want to prove that the source code I am using is the same as the open-sourced version, which is publicly available. My idea was to publish a hash of the open-sourced version and compare it to the ...
1
vote
2answers
175 views

Encrypting a password with its own hash

I just found out that an e-commerce platform (similar to Shopify) I was planning on using allows me to see my password. I know I can't assume anything and I should (probably) just run away from it, ...
0
votes
1answer
73 views

Main Reasons for GPG over hashing for verification

I have recently been introduced to GPG signing as a better way of verifying data than hashing. It was described that if you posted the hash of the file, someone could hack your website, alter the hash ...
0
votes
0answers
72 views

how to document and check apt inrelease files? are there blockchain records for that?

apt InRelease files update like twice every day, in ubuntu repositories and their mirrors. similarly in ubuntu and debian based distros, and other apt repositories. these files are small text files ...
8
votes
2answers
2k views

Should http basic auth passwords be stored hashed serverside?

HTTP basic auth sends credentials un-hashed and unencrypted over the wire, relying on TLS for confidentiality in transit. However, should the password be stored hashed using a standard KDF in the ...
0
votes
2answers
86 views

Is adding encryption before hashing more secure?

One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value. Does encrypting the password || salt then ...

1
2 3 4 5
41