Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
1answer
52 views

How to identify the right hash from a list of salts and pre-given password during authentication?

I apologize for being naive, but I only recently started learning about cryptography and how to go about the security online. From what I've gathered, the safest-without-sacrificing-efficiency way ...
0
votes
1answer
62 views

Does it increase security to hash a SHA1 hash with a common salt with SHA256 with individual salt [duplicate]

I tried to find a similar question but I did not find a question describing my exact scenario and I am still puzzled if the following actually makes an application more secure. I have legacy ...
40
votes
0answers
10k views

For a hashing function like MD5, how similar can two plaintext strings be and still generate the same hash? [migrated]

When I say similar, I'm referring to the Hamming distance, the Levenshtein distance, or a similar string distance metric that measures how similar or dissimilar two strings are. For instance, are ...
2
votes
0answers
60 views

Add additional rounds on existing SHA-512 salted hashes without knowing clear text password?

Assuming you have a salted SHA-512 password hash with 5000 rounds. For example: {CRYPT}$6$rounds=5000$6835c5dcf0bb7310$hVod/jy7uONMSa.FVpLHb/2OrWpAj3lB/....
3
votes
3answers
235 views

Password hashing algorithms suitable for IoT devices?

What password hashing algorithms and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home ...
0
votes
3answers
85 views

Is it possible to build a partial search mechanism on hashed values? [closed]

I am hashing some sensitive values to support search mechanism as decrypting the values at run-time would be time consuming. I'm using SHA-512 with salt. For now, things look good. I have the hashes ...
36
votes
8answers
15k views

Isn't “Dave's protocol” good if only the database, and not the code, is leaked?

I've read "Is my developer's home-brew password security right or wrong, and why?", but still there's a question wandering in my mind: Even if someone uses a bad, home-brewed security algorithm just ...
-2
votes
1answer
109 views

Which is the weakest hashing algorithm? [closed]

After studying about hashing algorithms and encryption formulas, I was interested to find which hashing algorithm was the weakest of all. I'm sure it is some weak and old algorithm, but it would be ...
0
votes
3answers
162 views

Can a hashing function be implemented insecurely?

After working on a an imaginary security related project, it was decided that the project is going to use the imaginary hashing function X. There are various implementations of the hashing function ...
0
votes
1answer
56 views

What does a hash output (a fingerprint) can be truncated mean?

From Public key fingerprint (Wikipedia) : Creating public key fingerprints ... 3. If desired, the hash function output can be truncated to provide a shorter, more convenient fingerprint. ...
0
votes
3answers
65 views

How to make the first request which used to create account safe? [duplicate]

To authorize user, our application defined below steps: Send user email and password (plain text) through HTTPS. When server received it, generate a salt to hash password and store it. When user ...
2
votes
1answer
79 views

Is there any benefit to using a salt when the cleartext is random data?

I understand that using a salt makes it harder to find cleartext using rainbow tables - but in that scenario the clear text is structured / low entropy. If my clear text is generated randomly, then is ...
2
votes
2answers
106 views

Hash value changes after first opening a file

Is it possible or normal that the hash value of a file changes just after the first opening/execution of it? I used sha256sum function within Ubuntu terminal to check the hash values before and after ...
2
votes
1answer
137 views

Cryptographic requirements for GDPR

I'm looking into how to store emails and data regarding GDPR. The reasoning is that it would be beneficial to store users emails linked to certain data (shop data about purchases and questionnaires). ...
1
vote
0answers
57 views

When knowing an individual's plaintext password history, how much information is expected to be gained with a new password? Do we know this?

The premise: Knowing a persons password history should provide information to help when guessing a new password of theirs. At an extreme end, with a password history of wildcats, wildcats1, then ...
0
votes
1answer
135 views

Estimating Password Cracking Speed Based on GPU?

I was wondering if there was a calculator or formula I could use to find a rough estimation of the time it takes to crack hashes based on GPU. I am trying to assess how much performance I would lose/...
1
vote
2answers
84 views

Should Google User ID's be hashed when stored in the database

I'm currently developing an auth backend that allows for both Google and Email/Password as authentication methods. I'm basically treating the Google ID and Password as credentials here. I'm already ...
62
votes
1answer
13k views

I found a password with hashcat, but it doesn't work

My assignment required me to find the password for a PowerPoint file (97 - 2003, v. 8.0 - v. 11.0). I used office2john.py to retrieve the hash, and I removed the file name. The hash is: $...
0
votes
0answers
66 views

Where are NTLM and LM hashes stored in a password protected microsoft presentation file

I have a password protected presentation file (MS office 2003). My assignment required me to either remove the password or find it. In my research i found out that presentation use ntlm and/or nt ...
1
vote
2answers
111 views

Can a document be digitally signed multiple times, successively by different users?

The question is, if a document that is collaboratively edited, one user per time, could be digitally signed by every editor before it is passed to the next editor. And if yes, could the final receiver ...
26
votes
4answers
6k views

Does putting salt first make it easier for attacker to bruteforce the hash?

Many recommendations for storing passwords recommend hash(salt + password) rather than hash(password + salt). Doesn't putting the salt first make it much faster for the attacker to bruteforce the ...
0
votes
0answers
87 views

Custom password security algorithm? [duplicate]

How secure would it be if you applied custom algorithms (that you obviously wouldn't reveal to the public) to a hashed password? Like splitting up a hashed string, shuffling it around, possibly even ...
0
votes
1answer
81 views

What kind of hash does the VeraCrypt tool use?

Whirlpool? SHA-512? Or something completely different?
26
votes
3answers
6k views

How bad would a partial hash leak be, realistically?

Even though the current recommendation for storing passwords is the usage of a slow key derivation function such as Argon2, scrypt, PBKDF2 or bcrypt1, many websites still use the traditional hash(...
2
votes
1answer
139 views

What are the minimum parameters for Argon2?

Argon2 is the winner of the Password Hashing competition, and currently recommended by OWASP for secure storage of passwords. One crucial step of Argon2 is determining the parameters used by the ...
0
votes
1answer
82 views

Can we implement custom algorithms to encode and decode wifi password hashes between Windows 10 and our Router?

Windows 10 has its own way of encrypting hashes, but these can be brute-forced by hashcat. One of our students created 2 of his own password encryption algorithms in python (One for encode, one for ...
-4
votes
2answers
135 views

How did Google “decode” my Gsuite password? [closed]

Google has recently admitted they were storing "G Suite" users' passwords un-hashed on their systems. But if a hashed password was transmitted to Google when I logged in to my account then how did ...
0
votes
1answer
46 views

How to make John the Ripper output example hashes for a given hash type?

Is it possible to make John the Ripper output example hashes for a given hash type given by the --format= option? This is possible using Hashcat, but currently I look in John the Ripper's source code ...
0
votes
0answers
123 views

Problems relaying NTLMv2 with Responder and MultiRelay

I'm currently experimenting with mitm relay attacks using Responder.py and MultiRelay.py tool and running into problems. I have the following LAB setup: Kali Box: IP: 192.168.1.13 ...
1
vote
3answers
192 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
0
votes
0answers
23 views

Password Hashing - Where does the Salt gets stored [duplicate]

I have read that it is a best practice to store Hashed passwords using Hashing algorithms which uses Salt to protect from Rainbow table attack. My question is- if i store the hashed password in my ...
1
vote
0answers
32 views

Manipulation-save logging

I have to keep a journal of all transactions that are performed in my application. Think of an invoice journal. What options do I have? E.g. an option in syslogd, or a table configuration in MySQL ...
1
vote
3answers
105 views

Which function to hash 128 bit API key with?

I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
0
votes
1answer
60 views

Do I need to use salt with api key hashing?

I will generate api keys. I plan to store their hashes instead of plain text. do i also need salt, similar to storing password? AFAIK salt prevents rainbow table attack and those are more ...
2
votes
4answers
422 views

Can a 32-bit hash be made into a 64-bit hash by calling it twice with different seed?

If I have a hash function that generates a 32 bit result with a good distribution (say murmur3): var h32 = hash32(str, seed); // returns a 32bit hex string (8 chars): '0123abcd' it will still ...
2
votes
2answers
62 views

Token-based group invitation link

I've searched this site and the web for an answer to this question, but haven't found what I'm looking for, so here goes. Pointers to existing relevant answers are much welcome as well. I'm building ...
29
votes
1answer
4k views

Why should password hash verification be time constant?

In the asp.net core PasswordHasher type there is is remark on the VerifyHashedPassword method /// <remarks>Implementations of this method should be time consistent.</remarks> And then ...
0
votes
1answer
47 views

does computing hash takes metadata into account?

I am currently trying to create a scan system, which identifies files that have been modified since the previous scan. It will work on some directories/files and identify the content which have been ...
0
votes
0answers
73 views

What prevents the client from changing the signature in files?

From what I can tell, some software licenses work client side. For example, when looking in to the purchased software for the first time, the server will return a software license. In order to ...
0
votes
0answers
25 views

if password hash algorithm is broken, is best practice to re-hash the hashes with a new hash? [duplicate]

Suppose you store a bunch of hashed passwords, but your hashing algorithm gets broken. What is the best practice? It seems like the only safe practice would be to take the old password hashes (...
0
votes
1answer
180 views

WebGoat 8: JWT Tokens Lesson 5 using hashcat to crack signature [closed]

I cracked the hash, and I got this: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9....
2
votes
1answer
95 views

Plausible way to hack website keeping [username / hashed password] pairs?

I was reading that a lot of authentication systems use cryptographic hash functions, whereby instead of keeping the username and password of their users they just keep the username and a hash of the ...
0
votes
1answer
120 views

Why does Google still use SHA-1 for securing API keys if its been compromised?

If you read Google's best practices for use account you'd see them warning against using SHA-1. They have even purposefully cracked it in 2017. If that's the case, then why when you restrict google ...
1
vote
1answer
112 views

Using BITMAIN AntMiner L3+ for cracking password [closed]

I want to use a BITMAIN AntMiner L3+ miner to crack passwords. How can I do that? Can I install hashcat agent to L3+ ?
0
votes
1answer
87 views

Decrypt hash using dicionary attack

Let's consider that I'm the attacker and have access to hashes of passwords of a given database against which I will attempt a dictionary attack. My question is: Will I be able to find out by ...
3
votes
0answers
69 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
2
votes
1answer
590 views

How to dynamically generate the hash value of a file while it gets downloaded from any website?

I've tried generating the hash value of a file that is trying to get downloaded and compared it against the list of hash values, and if there is a match then it doesn't get downloaded.Here i have ...
0
votes
1answer
57 views

Password storage which avoids privileged insider attack

What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
3
votes
1answer
171 views

Is hashing without a salt secure for random passwords? [duplicate]

I'm designing an API with token authentication. I don't want to store tokens as plain text in the database, for the same reason user passwords are not stored as plain text: if the database gets ...
2
votes
0answers
65 views

Extracted LM Hashes doesnt match actual password

I'm new to LM Hashing and Windows authentication, and I'm having problems with LM hashes. I've created 2 accounts with the password "123", and both of them have different hashes, and none of the ...