Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0 votes
0 answers
28 views

How to Infer Key from Hash and Password? [closed]

I have a hash H1 and a password P1. The hash is MD5. I have another hash H2 without a password. Can I leverage my knowledge of H1 and P1 to get a key? can I use this key to decrypt H2? Are there ...
user avatar
0 votes
1 answer
45 views

Hashing email addresses using scrypt

I want to hash email addresses so that they are anonymous but still unique in my database. I was thinking of using scrypt for this and creating the salt as a sha256 of some secret stored on the server ...
user avatar
  • 193
0 votes
0 answers
4 views

Can you break PBKDF2 if you know the hash of the password? [migrated]

I know that PBKDF2 hashes the password a number of times, the result being a key. Can an attacker find the key if they don't know the password, but know the value of the hash of the password?
user avatar
0 votes
0 answers
11 views

Can I store subject from a JWT from an external auth server in my DB?

We are retrieving external users using OpenID with the PKCE flow. We are using the JWT returned from the auth server to authenticate the user. If it is valid, we extract the subject field from the ...
user avatar
  • 101
0 votes
1 answer
53 views

Is this 36 character long string a hash [closed]

I found this string b2335332-d28f-449b-8d00-80a550b43046 Do you think it´s a hash? If yes any idea which one and if not any other ideas what it could be?
user avatar
1 vote
1 answer
46 views

Good checksum algorithm for backup / cloud sync system

I am writing a cloud backup system, and want to use a checksum to know if a file has been modified, and accordingly sync it with the server. This question shows that xxHash is super fast, and this ...
user avatar
  • 113
1 vote
1 answer
46 views

Do we know a MD5 collision exploiting PHP loose type comparision (0123e2 == 123e02 == 012300)?

Since PHP has loose type comparison, we have: php -r 'var_dump("1234e03"=="1234000");' bool(true) And since MD5 hashs are often reprensented as hexa string like ...
user avatar
  • 1,341
8 votes
3 answers
3k views

Argon2 vs SHA-512, what's better in my case?

First I am very bad in cryptographic algorithms. I found online that Argon2 is more secure than SHA-512, so I used it for password hashing. There're recommended options for Argon2: Memory: 4Gb ...
user avatar
1 vote
1 answer
97 views

Potential problems with insecure password hashing

For my job I use some industry-specific software that stores sensitive information. The software has a web interface with a public login page. One time I attempted to log in, but mistyped the last few ...
user avatar
17 votes
4 answers
3k views

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work? Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum ...
user avatar
  • 181
1 vote
2 answers
44 views

Is there a relationship between the size of RSA key and size of hash function?

I have seen that for RSA2K the hash function SHA-256 has been used. Now my question is if I want to use RSA3K, should I change the size of the hash function for example from SHA-256 to SHA-384? Is ...
user avatar
  • 113
0 votes
0 answers
30 views

What are the underlying mechanics that make password salting an effective deterrent against Rainbow Tables? [duplicate]

I have a top level familiarity with Rainbow tables (1 ,2 ) I also understand that salting adds a randomly generated alphanumeric string to each password before it gets hashed and put in a database. My ...
user avatar
1 vote
1 answer
57 views

Why is this trusted .exe not showing up as signed in Virustotal?

So I was about to install Battle.net Desktop App to play some World of Warcraft. Downloaded from the official Blizzard.com website. (https://www.blizzard.com/en-us/apps/battle.net/desktop) Just out of ...
user avatar
2 votes
1 answer
91 views

If multiple of the same password have the same hashed value in a database, does that mean the password is not being salted?

I just started a new job last week and I'm asking for a sanity-check before I mention this to anyone. All the new employee accounts are created with the same default password (I know, already a no-no)....
user avatar
6 votes
2 answers
2k views

Can you use an FPGA with hashcat?

Hashcat list FPGAs as opencl device type in its help. - [ OpenCL Device Types ] - # | Device Type ===+============= 1 | CPU 2 | GPU 3 | FPGA, DSP, Co-Processor So can you really somehow connect and ...
user avatar
7 votes
6 answers
5k views

What's the point of hashing a password and then sending it to the server?

If the password is hashed and then sent to the server where the hash is compared to the stored hash, this basically means that if someone had that hash they can still log in by sending the hash in the ...
user avatar
3 votes
1 answer
72 views

Hashing to protect privacy

I like to know if hashing protects privacy enough, i.e., if a hash of PII is still considered to be personally identifying information (PII). I found this article: https://www.johndcook.com/blog/2019/...
user avatar
  • 31
4 votes
1 answer
513 views

Actual definition of a Message Digest?

I'm having a hard time to find a clear and definitive definition of what a Message Digest is in regards to hashing algorithms. Some sources state it's the hashing function itself. Other sources state ...
user avatar
  • 143
1 vote
3 answers
156 views

Proving that a file existed at a time

How do I acquire the means to prove in the future that I had possission of a file now, without relying on the integrity of a single entity? (I believe one way of doing it would be to put the file ...
user avatar
1 vote
0 answers
20 views

Can I trust a hash commit for integrity of the entire repository? [duplicate]

Sometimes there's no tar release for some repo in github, and the download as zip button only generates a random zip with random hash. So, in my Dockerfile, I want to clone a repo but be able to check ...
user avatar
0 votes
1 answer
88 views

Hashcat brute force - markov chains

Hashcat uses Markov chains by default when using brute force mode. Do they really speed up the cracking since a randomly generated password normally has the same probability for every combination?
user avatar
0 votes
0 answers
39 views

How is a TLS certificate authenticated, down to a code level? [duplicate]

I am having trouble to understand how a TLS certificate is authenticated. From what I read, a server's leaf certificate contains: Server domain name Server public key Issuer (CA) domain name Issuer (...
user avatar
  • 101
0 votes
2 answers
55 views

Design for deleting users accounts, yet knowing when they register again

My webapp takes in email addresses as user names at registration, verifies ownership by sending emails with confirmation links, etc. I'm now looking for a secure design of a user deletion feature, ...
user avatar
0 votes
0 answers
31 views

Certificate encryption and hash algorithm [duplicate]

I was creating self-signed certificate with OpenSSL and had to choose encryption and hash algorithm. Are those algorithms used for encryption between client and a server? If not, then what are these ...
user avatar
  • 1
6 votes
1 answer
369 views

How can a .exe be modified and still keep a valid digital signature?

When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true. ...
user avatar
0 votes
1 answer
78 views

How to securely hash sensitive data and make the hash public, while preventing an attack by someone who know the structure or some part of the data?

In a nutshell, I need: to hash a file and to make this hash public, to be able to prove data integrity when sharing the data privately with a trusted third party. to choose the right hashing method ...
user avatar
  • 3
0 votes
1 answer
95 views

Hash collisions in password history

When a user changes password, I'd like to implement a simple check that prevents them from reusing the same password. If the new password matches the old password, reject with an error. Sounds easy, ...
user avatar
  • 1,260
0 votes
0 answers
55 views

Why we need complicate truncation for the OTP?

If we assume that Time based OTP generates the OTP using the hash function like SHA-3. Then, the generated OTP would Hash(Secret, Shared time). We want a shortened string rather than a full hash ...
user avatar
1 vote
3 answers
105 views

AES Encryption vs hash function with the strong assumption of input size and secure key?

There are plenty of questions about the difference between AES encryption and hash functions. I read some of them and the general answer is that AES is reversible as long as the key is exposed. AES ...
user avatar
  • 11
0 votes
1 answer
68 views

HMAC SHA256 by using a static key + text as a key

Maybe it's not a good idea, but I would like to check it with you. When using HMAC SHA to hash a clear text value (string max 30 char) I need to use a key (256) but in my scenario this key is static ...
user avatar
0 votes
0 answers
37 views

Can I find the private key on an old Android Wallet's source code?

I recently found an old wallet from my younger self with God-knows what kind of embarrassing data on it. I only found the back up files on a cloud service and did some digging as to what it was when ...
user avatar
0 votes
0 answers
49 views

Are hashed passwords transferred to a server for user authentication? [duplicate]

A question I came up with while reading in my information security class. Let's say website ABC which uses username and password combinations to authenticate users and has a user John. When John goes ...
user avatar
  • 1
0 votes
1 answer
75 views

Verify password before decrypting data

I need to verify a password before decrypting the data. My encrypted data is too big and waiting to see if the authentication tag is correct is out of the question. I’m using Argon2id as my KDF. My ...
user avatar
1 vote
2 answers
105 views

For common hashes, are their collision risks similar when considering only the first N bytes?

Question in short: If I consider just the first 16 bytes of SHA-1 and SHA-256 hashes, do they have substantially the same collision risk? Background: I have an application where I need a 16-byte (...
user avatar
7 votes
1 answer
2k views

With password cracking, what is the fastest known password cracking rig in hashes per second? [closed]

To properly assess password strength, I have been trying to research what the fastest known password cracking rig is in hashes per second. HashCat claims that their software is the world's fastest, ...
user avatar
0 votes
1 answer
44 views

How do different secret-key algorithms generate the same data?

How do different secret-key algorithms generate the same data? In the snippet below, I use PBEWithMD5AndDES to produce one key, and PBEWithHmacSHA256AndAES_256 to produce another key, but with the ...
user avatar
  • 3
0 votes
0 answers
79 views

Hash-Based Technique to Detect Ransomware Corruption on the Fly?

I have developed an Excel spreadsheet to compare lists of SHA-512 hashes from two separate drives. One drive is the source data drive on a Windows machine. The other is a backup of that drive, ...
user avatar
27 votes
6 answers
9k views

Is it safe to store a password using a secure hash followed by an insecure hash?

I'm working with some middleware that requires username/password authentication. The middleware uses MD5 hash for the password. The MD5 hash, of course, is not fit for the purpose of storing passwords....
user avatar
  • 9,061
0 votes
2 answers
92 views

How different ldap implementations are generating random salt?

I am currently generating a salted SHA 256 passwords in the below format $hash = "{SHA256}".base64_encode(hash('sha256', $password . $salt) . $salt) . Using the below libraries of Java ...
user avatar
2 votes
3 answers
405 views

How can I extract salt from encoded base64 Salted SHA 256 hashed password

I have a SSHA256 hashed password. Below is the plaintext and hashed password for it. PlainText -p@ssw0rd Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
user avatar
0 votes
1 answer
112 views

Using John or hashcat when password stub is leaked by weak crypto

I'm pentesting a system (call it X) which uses an internal secret key. Due to weaknesses in the crypto, I can determine: The SHA1 hash of the key (stored as a checksum) With high probability, the ...
user avatar
0 votes
1 answer
83 views

Find pre-images of hashed email addresses

This is a cryptographic challenge I was given: I have a list of 1000 hashed email addresses where I know the domain name for them (eg. "@gmail.com"). According to hashes.com: Possible ...
user avatar
2 votes
3 answers
120 views

What is the best way to store the verifyer for posession of a high entropy secret?

This is just a thought experiment. I am trying to get an understanding on when we need password hashing functions and when they don't bring any benefits (eg. to save on calculation cost). I know that ...
user avatar
  • 695
0 votes
1 answer
57 views

How does TLS use hashing from the negotiated cipher suite

I am trying to understand why TLS only uses hashing algorithm like SHA-384 instead of using an HMAC instance like HMAC-SHA-384. If I understand correctly, this cipher suite (...
user avatar
  • 25
0 votes
1 answer
143 views

UUIDs replacing inremental IDs in URLs

I am reading about implementing UUIDs in URLs instead of incremental IDs to reduce attack vectors using obfuscation. I plan to create a UUID from an incremental ID and store the UUID which would be ...
user avatar
  • 133
0 votes
1 answer
123 views

Get hash algorithm knowing hash, salt and password [duplicate]

I have multiple salted hashes and I know the passwords, but I want to know the algorithm used to make the hash. For example, hash dcdc884c4ead4f713e9d15c1e14f5b07dfe184ea salt 93295 password xx123123 ...
user avatar
0 votes
2 answers
804 views

John The Ripper does not load password hash, how can I fix it?

I want to crack a specific hash password with JTR: 48bb6e862e54f2a795ffc4e541caed4d I put this hash in a txt file like this: echo '48bb6e862e54f2a795ffc4e541caed4d' > hash.txt and I run JTR in ...
user avatar
0 votes
0 answers
63 views

double hashing for code signing and verification

I have environmental constraints where the cyber and safety functions are segregated such that safety operations are handled by one unit and cyber operations such as firewall, HIDS, secure storage etc....
user avatar
0 votes
1 answer
112 views

What tools currently allow to retrieve Windows 10/11 password hashes, given admin rights or physical access to unencrypted disks?

I was wondering what Windows/Linux/Live tools allow to retrieve user password hashes of modern 2021 Win10/11 installations. I am not sure if password storage differs in these cases (e.g. different ...
user avatar
  • 23
29 votes
5 answers
8k views

Security of hashing and encryption algorithms for 30 years

Assuming a product shelf life of 30 years and the product which is released now in 2021, what is the recommendation/suggestion for hashing or encryption algorithms to use in the product? That means, ...
user avatar

1
2 3 4 5
44