Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

6
votes
2answers
918 views

Hashing email addresses for GDPR compliance

We'd like to keep users old account email addresses in a database for the sole purpose of allowing them to reconnect old accounts of their new accounts. This would benefit them and be a cool feature, ...
0
votes
1answer
42 views

How to prevent replay attacks without exposing stored password security?

A common way to prevent replay attacks when logging in is for the server to present a challenge (chall) and request a response in the form hash(chall+secret) where the secret is already known by the ...
0
votes
1answer
52 views

hashcat specify number of characters

I am trying to figure out a macOS hash 10.8+ and I happen to know that it uses A-Z, a-z, 0-9, is 6-8 characters, and almost certainly random. Currently, it spits out an error regarding hash length ...
-1
votes
1answer
34 views

Is a md5 actually unable to be reversed? [duplicate]

If a md5 is one way and supposedly unable to be reversed why do we still have large data breeches with user names and passwords. Are these companies storing passwords in plain text?
1
vote
2answers
69 views

Is there any advantage to combining a hash algorithm with a key-derivation function?

Let's assume I would like to secure passwords using a modern KDF such as Argon2. The flow of information would look like this: $hash,$salt = argon2id($password, $salt). Is there any advantage to ...
3
votes
2answers
123 views

How can a client verify that code sent from the server has not been tampered with?

While trying to understand the recent controversy involving ProtonMail, I started to wonder if its possible to verify that the opensource JavaScript being sent from the server to the client hasn't ...
0
votes
1answer
22 views

How are these transaction fingerprints colored?

For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
2
votes
2answers
290 views

Is it worth storing email addresses as hashes?

If your running a web services with lots of users and you get hacked, you may be giving away users's plain text information like email and hashes like password hashes. Is it worth storing email ...
0
votes
1answer
155 views

Why is a 32 character hex string not a md5 hash? [closed]

This string, when dropped into hash detection tools, is not being identified as a hash. As far as I knew, an md5 has was a 32 digit string with hex numbers. Everything below is hex. So what other ...
1
vote
1answer
75 views

Can I identify a hash function with neural network?

Can I use neural network to identify a hash function like sha256? I mean, generate a bunch of hash codes by different hash functions and also labels. Then, feed these codes into a neural network. Will ...
1
vote
1answer
149 views

Using hashcat in order to crack the JWT signature in WebGoat

I've recently started to practice my penetration testing skills and I got started with WebGoat. I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT ...
1
vote
0answers
17 views

What is better way of transmitting password input? Plaintext or its hash value? [duplicate]

Let's just say there is a client and a server. The end-user inputs his/her password in the client interface. Then the data will be sent to the server for validation. In terms of security, would it be ...
0
votes
1answer
69 views

Using the filehash as the key [closed]

I want to ensure that everyone who encrypts a given file gets the same encrypted file without knowing the password. So, my idea was the following: hash the file encrypt the file (e.g. AES) with the ...
0
votes
1answer
58 views

what is the best algorithm for hashing stored users info on client-side on a web app

I have this scenario in a web app which I'm working on its client-side code(I'm building it with ReactJS): I obtain user's info hash 'em send it to the server for being authenticated and when I get ...
1
vote
1answer
48 views

Why do some websites have their hashes on the same area as the download link? [duplicate]

Some sites allow us to use hashes to make sure that the file we download is what it should be and that it is not tampered with. Some sites may have their hashes on a different domain probably on a ...
1
vote
1answer
101 views

How to crack a list of hashed passwords given their possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256 using some java code. I have the hashes available and I also have the possibilities in which the password can be. Some ...
0
votes
1answer
55 views

Hash to malware file generation

I was watching a video from one of the youtube channel on reverse engineering. One of the topic is how to get free malware for static analysis. During the discussion, it was mentioned that people can ...
0
votes
1answer
70 views

What is a collision attack in simple terms? [closed]

I'm not a security expert but I've got interested in Cryptography and I'm reading about it. I was trying to find out which is the best between SHA256, Bcrypt and MD5 when it comes to hashing ...
0
votes
0answers
101 views

How is a birthday attack actually performed?

I thought I understood the birthday attack until I tried to actually implement it. Either I'm implementing it wrong, or there's something wrong with my interpretation of the resulting probabilities. ...
0
votes
0answers
43 views

How do I combine a salt and hash for John The Ripper? [duplicate]

I found a password hash *61A2BD98DAD2A09749B6FC77A9578609D32518DD I found a salt somewhere else. How do I combine these to feed into John the Ripper? When I run John on the hash (minus the *) John ...
1
vote
2answers
107 views

Best way to encrypt a username in a database?

In my database, I would like to encrypt every identifiable piece of information, including the username, such that people with access to the database cannot deduce the actual username (because it ...
0
votes
1answer
39 views

Are all fields of the PE certificate directory hashed during authenticode signing?

In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
4
votes
2answers
297 views

How does a zip file detect a correct password?

When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file. How does an encrypted ZIP detect when the user has given the correct ...
1
vote
2answers
109 views

How to crack a password given its hash and its possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256. I have the hashes available and I also have the possibilities in which the password can be. Some of these possibilities ...
-4
votes
2answers
135 views

How secure is my hashing algorithm? [duplicate]

This is probably the common question on stack exchange but I need to know is this really safe as it seems to be? //Password hashing stage 1 $a_password = sha1($a_password); $a_password = md5($...
1
vote
1answer
593 views

I know salt and hash(password + salt), how do I get hash(password)?

...If it's possible at all. By hash I mean md5, sha1, sha256. And how difficult is it? I mean, if it's possible mathematically, are there any tools around?
1
vote
2answers
210 views

Which hashing algorithm shoud I use for a safe file checksum?

For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them. To protect the integrity of the work I have done and to guarantee it has never ...
3
votes
1answer
50 views

Can I securely keep the user logged into my local application AND use the password as a decryption key?

I'm somewhat new to data encryption/safety, but I already read about basic concepts like hashing passwords, encrypting files, etc. If possible, please ELI5 - thanks in advance. Background: my ...
2
votes
3answers
159 views

Password-hash proofing SHA-3

I am in a situation where I need to harden a password hash, but not allowed to bring in any extra dependencies, so I am pretty much forced to do the one thing everyone seems to advise against - roll ...
0
votes
1answer
35 views

Password hashing on both client and server : what are the risks concerning hash composition (collisions and reversing)?

There are plenty of question addressing the "client / server : where to hash ?", but i have not found anything about my particular question : considering a server_salted_hash(client_salted_hash(...
2
votes
1answer
65 views

Hash password with bcrypt before encrypting document with openpgp

Hi all first time posting thanks for putting together this great community. I'm working on an extension to allow users to store encrypted documents on a server I host. I'd like to avoid having them ...
33
votes
3answers
7k views

What does “in-house hash function” mean?

In security news, I faced a new term related to hash functions: it is reported that the "in-house hash function" used in IOTA platform is broken (i.e. Curl-P hash function). You can find the complete ...
44
votes
12answers
15k views

Is it better to use an unsuitable hashing algorithm instead of none at all?

I have to store passwords on a system which doesn't offer any of the algorithms recommended for hashing passwords (e.g. bcrypt, scrypt or PBKDF2). Would it be better to use an unsuitable algorithm (e....
0
votes
3answers
168 views

Are hashes a reliable method of ensuring a file has not been tampered with?

Suppose I have a file and that I want to confirm that this file is the same as the original (IE: it has not been altered in any way) using hashing. If I were to use a hash function that has no known ...
3
votes
1answer
111 views

Difference in between salt and random padding in cryptography

I would like to know what is difference in between using salt and using "random padding" in cryptography. I am familiar with term salt when we use it with hashing. How does "random padding" differ ...
1
vote
0answers
93 views

Help figuring out this hash function [closed]

I have a tough nut to crack. I'm working on hashing passwords for our network switches (because the alternative is plain-text passwords...). For people who would care about this; it's a huawei switch. ...
26
votes
10answers
10k views

How to secure passwords over HTTP?

Say my password is abc. I want to send it to the server over HTTP. I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
54
votes
5answers
13k views

Is it bad practice to prefix my hash with the algorithm used?

Let's say I have a database with a bunch of users in it. This user database would typically have a hashed password per user. Would it be bad practice to prefix this hash with the hashing algorithm ...
0
votes
0answers
40 views

Derive random output from payload & encryption key and verify it without knowing the payload

I want to know if this type of hashing or encryption scheme exists. Let's say there is a master key : 'abcdefg' I want to encrypt the payload : '2018-11-08 22:11:02' The output : '...
1
vote
1answer
50 views

preimage resistance [duplicate]

I'm struggling to get a clear understanding of second preimage resistance and collision resistance. Research on the internet yielded the following definitions: Second pre-image resistance Given an ...
2
votes
4answers
144 views

Is an authenticated server seeing the plaintext password a serious problem?

Typically a server ends up observing the plaintext password sent by a user at some points (correct me if it is not). Assuming that there is a secure channel established and the data are confidential, ...
1
vote
0answers
32 views

Rotating session names vs a static session name with a rotating validation string

I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon ...
1
vote
1answer
51 views

How to support search of data under PCI-DSS?

Suppose that the data in question is a card PAN. According to PCI-DSS, you have to store it with extra security (encrypt it before storing in database and store the secret key elsewhere with more ...
0
votes
1answer
117 views

Bots trying to spoof encoded email links, but why?

I've setup an application for my client, that sends lists of job vacancies to subscribers every Monday morning. The emails use a custom link redirector service, to make the links email friendly, and ...
3
votes
3answers
129 views

Is it possible to use “cryptographic hash function” for “digital signature”?

I understand that a cryptographic hash function is a function that generates a fixed size random string for an arbitrary input. However, is it possible to use a cryptographic hash function for ...
0
votes
0answers
137 views

How to mask attack a sha256 hash with following information using hashcat?

I am hashcat newbie and I want to crack a hash :) The answer is 1-15 (unknown) characters and it may contain 'a-z' 'A-Z' '0-9' and '_' . (A Twitter username) How may I mask attack a hash with above ...
1
vote
2answers
129 views

Does a File's Checksum Change after it is Digitally Signed?

From my understanding, when you digitally sign a file, it changes that file's checksum because they are bundled together. Example of what I mean: file1.txt only contains the letter 'd' and the ...
0
votes
0answers
14 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
1
vote
4answers
224 views

Why should we protect access to password hashes?

Why should we protect the access to the password hashes? And under what conditions can this precaution be omitted?
1
vote
0answers
38 views

Increase password iterations?

Is it possible to strengthen the macOS login password by increasing the number of sha-512 iterations?