Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

0
votes
0answers
32 views

Where are NTLM and LM hashes stored in a password protected microsoft presentation file

I have a password protected presentation file (MS office 2003). My assignment required me to either remove the password or find it. In my research i found out that presentation use ntlm and/or nt ...
1
vote
2answers
106 views

Can a document be digitally signed multiple times, successively by different users?

The question is, if a document that is collaboratively edited, one user per time, could be digitally signed by every editor before it is passed to the next editor. And if yes, could the final receiver ...
26
votes
3answers
5k views

Does putting salt first make it easier for attacker to bruteforce the hash?

Many recommendations for storing passwords recommend hash(salt + password) rather than hash(password + salt). Doesn't putting the salt first make it much faster for the attacker to bruteforce the ...
0
votes
0answers
79 views

Custom password security algorithm? [duplicate]

How secure would it be if you applied custom algorithms (that you obviously wouldn't reveal to the public) to a hashed password? Like splitting up a hashed string, shuffling it around, possibly even ...
0
votes
1answer
70 views

What kind of hash does the VeraCrypt tool use?

Whirlpool? SHA-512? Or something completely different?
26
votes
3answers
6k views

How bad would a partial hash leak be, realistically?

Even though the current recommendation for storing passwords is the usage of a slow key derivation function such as Argon2, scrypt, PBKDF2 or bcrypt1, many websites still use the traditional hash(...
2
votes
1answer
125 views

What are the minimum parameters for Argon2?

Argon2 is the winner of the Password Hashing competition, and currently recommended by OWASP for secure storage of passwords. One crucial step of Argon2 is determining the parameters used by the ...
0
votes
1answer
56 views

Can we implement custom algorithms to encode and decode wifi password hashes between Windows 10 and our Router?

Windows 10 has its own way of encrypting hashes, but these can be brute-forced by hashcat. One of our students created 2 of his own password encryption algorithms in python (One for encode, one for ...
-4
votes
2answers
130 views

How did Google “decode” my Gsuite password? [closed]

Google has recently admitted they were storing "G Suite" users' passwords un-hashed on their systems. But if a hashed password was transmitted to Google when I logged in to my account then how did ...
0
votes
1answer
42 views

How to make John the Ripper output example hashes for a given hash type?

Is it possible to make John the Ripper output example hashes for a given hash type given by the --format= option? This is possible using Hashcat, but currently I look in John the Ripper's source code ...
0
votes
0answers
73 views

Problems relaying NTLMv2 with Responder and MultiRelay

I'm currently experimenting with mitm relay attacks using Responder.py and MultiRelay.py tool and running into problems. I have the following LAB setup: Kali Box: IP: 192.168.1.13 ...
1
vote
3answers
186 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
0
votes
0answers
23 views

Password Hashing - Where does the Salt gets stored [duplicate]

I have read that it is a best practice to store Hashed passwords using Hashing algorithms which uses Salt to protect from Rainbow table attack. My question is- if i store the hashed password in my ...
1
vote
0answers
30 views

Manipulation-save logging

I have to keep a journal of all transactions that are performed in my application. Think of an invoice journal. What options do I have? E.g. an option in syslogd, or a table configuration in MySQL ...
1
vote
3answers
100 views

Which function to hash 128 bit API key with?

I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
0
votes
1answer
41 views

Do I need to use salt with api key hashing?

I will generate api keys. I plan to store their hashes instead of plain text. do i also need salt, similar to storing password? AFAIK salt prevents rainbow table attack and those are more ...
1
vote
4answers
325 views

Can a 32-bit hash be made into a 64-bit hash by calling it twice with different seed?

If I have a hash function that generates a 32 bit result with a good distribution (say murmur3): var h32 = hash32(str, seed); // returns a 32bit hex string (8 chars): '0123abcd' it will still ...
2
votes
2answers
54 views

Token-based group invitation link

I've searched this site and the web for an answer to this question, but haven't found what I'm looking for, so here goes. Pointers to existing relevant answers are much welcome as well. I'm building ...
29
votes
1answer
4k views

Why should password hash verification be time constant?

In the asp.net core PasswordHasher type there is is remark on the VerifyHashedPassword method /// <remarks>Implementations of this method should be time consistent.</remarks> And then ...
0
votes
1answer
44 views

does computing hash takes metadata into account?

I am currently trying to create a scan system, which identifies files that have been modified since the previous scan. It will work on some directories/files and identify the content which have been ...
0
votes
0answers
71 views

What prevents the client from changing the signature in files?

From what I can tell, some software licenses work client side. For example, when looking in to the purchased software for the first time, the server will return a software license. In order to ...
0
votes
0answers
25 views

if password hash algorithm is broken, is best practice to re-hash the hashes with a new hash? [duplicate]

Suppose you store a bunch of hashed passwords, but your hashing algorithm gets broken. What is the best practice? It seems like the only safe practice would be to take the old password hashes (...
0
votes
1answer
134 views

WebGoat 8: JWT Tokens Lesson 5 using hashcat to crack signature [closed]

I cracked the hash, and I got this: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9....
2
votes
1answer
92 views

Plausible way to hack website keeping [username / hashed password] pairs?

I was reading that a lot of authentication systems use cryptographic hash functions, whereby instead of keeping the username and password of their users they just keep the username and a hash of the ...
0
votes
1answer
107 views

Why does Google still use SHA-1 for securing API keys if its been compromised?

If you read Google's best practices for use account you'd see them warning against using SHA-1. They have even purposefully cracked it in 2017. If that's the case, then why when you restrict google ...
1
vote
1answer
101 views

Using BITMAIN AntMiner L3+ for cracking password [closed]

I want to use a BITMAIN AntMiner L3+ miner to crack passwords. How can I do that? Can I install hashcat agent to L3+ ?
0
votes
1answer
86 views

Decrypt hash using dicionary attack

Let's consider that I'm the attacker and have access to hashes of passwords of a given database against which I will attempt a dictionary attack. My question is: Will I be able to find out by ...
3
votes
0answers
67 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
2
votes
1answer
590 views

How to dynamically generate the hash value of a file while it gets downloaded from any website?

I've tried generating the hash value of a file that is trying to get downloaded and compared it against the list of hash values, and if there is a match then it doesn't get downloaded.Here i have ...
0
votes
1answer
56 views

Password storage which avoids privileged insider attack

What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
3
votes
1answer
158 views

Is hashing without a salt secure for random passwords? [duplicate]

I'm designing an API with token authentication. I don't want to store tokens as plain text in the database, for the same reason user passwords are not stored as plain text: if the database gets ...
2
votes
0answers
54 views

Extracted LM Hashes doesnt match actual password

I'm new to LM Hashing and Windows authentication, and I'm having problems with LM hashes. I've created 2 accounts with the password "123", and both of them have different hashes, and none of the ...
-1
votes
1answer
77 views

Can one alter SHA-1 input data without changing the hash internal state? [duplicate]

Let's say I have an input message of "enoughly long" length (I'll got for a 128 bytes long message, but it might be 256 or whatever). I know the hash sha1(message || secret) where || is byte ...
1
vote
2answers
211 views

PHP password_hash (bcrypt) vs sha-3 [duplicate]

password_hash() is the recommended function in PHP to generate password hashes. The standard usage is password_hash($password, PASSWORD_DEFAULT); and default hash with PASSWORD_DEFAULT is bcrypt. The ...
1
vote
2answers
113 views

Comparing uniquely salted hashes

I have a system which needs to compare hashed identifier values. I want to salt my hashes, to prevent them being cracked with a rainbow table. However, the system needs to be able to compare the ...
0
votes
0answers
39 views

Is there a protocol fuzzer or fuzzing framework that uses cryptography?

When reading about fuzzing, the way to go seems to ignore checksums and cryptographic integrity protection or at least circumvent verification procedures via a 'fuzz-friendly mode'. For black-box ...
-1
votes
1answer
56 views

Is this method of storing a data-field secure?

I'm trying to convert a data field to something tokenized(that's to something not-sensitive). The current scenario is, I've got a data field (assume user-id) which is unique for each user, I don't ...
0
votes
1answer
450 views

Hashcat - separator unmatched running pmkid 16800 crack

I'm working on cracking a pmkid file. I have collected pcap file using bettercap. Then convert using this: hcxpcaptool -z bettercap-wifi-handshakes.pcap.pmkid bettercap-wifi-handshakes.pcap They ...
0
votes
1answer
84 views

When encrypting password hashes, how to handle nonces?

I know that encrypting password hashes is a contentious issue. However, I have seen it recommended in some quarters. I know for instance that DropBox did this at one time with AES256. In these cases, ...
3
votes
1answer
91 views

Is there any benefit using a two-step salted hash? [closed]

Commonly when implementing authentication mechanisms that accept passwords is to add salt when hashing the password. Reading the article here: https://engineering.gosquared.com/evolution-of-password-...
1
vote
3answers
192 views

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
1
vote
1answer
74 views

Schemes for ID obfuscation like Facebook app scoped IDs

After certain privacy concerns Facebook rolled out a bunch of changes to their APIs, one being "scoping" user identifiers per app. In effect, this means that Alice's canonical facebook user ID is ...
0
votes
0answers
81 views

Is gnupg2 --refresh-keys susceptible to any attacks based on fingerprint collisions?

Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys Mallory ensures that Bob uses her keyserver, which offers her own key, which is sharing the 32-bit "short" Key ...
2
votes
1answer
64 views

What hashing algorithm does VirtualBox use for passwords in its config files?

To authenticate with RDP, VirtualBox allows to set a password using this command: VBoxManage setproperty vrdeauthlibrary "VBoxAuthSimple" VBoxManage modifyvm "VM name" --vrdeauthtype external ...
0
votes
2answers
148 views

Appending a secret (pepper) to Argon2 password hashes

I've read quite a bit of the StackExchange and HackerNews debates on the user of "peppers" in password hash security. There are a number of different implementations of the idea of a pepper, ranging ...
1
vote
3answers
149 views

Hash pepper in web application possible?

I have read a few articles and several question on here about hashing correctly. While hashing, adding salt and especially pepper is primarily a server side use case, I am interested in the ...
0
votes
0answers
170 views

bcrypt.checkpw() returning true for different salt+hash

new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
0
votes
0answers
43 views

Web app: using two hashing schemes for CPU-friendly password validation & secure storage [duplicate]

Consider a web application that: uses HTTP Basic Auth over HTTPS, and therefore needs to validate a password (an API Key) on every request and needs to handle a substantial load has very few distinct ...
13
votes
3answers
4k views

Hashing password to increase entropy

Is it secure to hash a password before using it in an application to increase password entropy? Does this practice increase entropy when a PBKDF is used in the application itself or does the PBKDF ...
0
votes
1answer
100 views

Can't detect hash type even if I have the password?

I can't found the hash type used in a database hosted in a VM. My hash is c39e02416d974229752c28d7fcefe6e1, and my password is "azerty123456". I noticed that the user table has a column called ...