Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

0
votes
0answers
45 views

John the Ripper quits before cracking hash

I have a single raw-md5 hash that I want to crack. I've put it in a proper text file without a trailing linespace. I also want to use a wordlist for this. However, john exits before actually trying to ...
0
votes
0answers
31 views

Reciving unknown hashes though SMS, Help identifying them [on hold]

I've been receiving random base64 ?hashs? though SMS. I have no clue to their function or origin and no reason i should be receiving them. Example: SkY#AgAxAbxDcJ2Id9JvUxwkaWAFVIOWqc+...
24
votes
11answers
9k views

How to secure passwords over HTTP?

Say my password is abc. I want to send it to the server over HTTP. I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
50
votes
5answers
13k views

Is it bad practice to prefix my hash with the algorithm used?

Let's say I have a database with a bunch of users in it. This user database would typically have a hashed password per user. Would it be bad practice to prefix this hash with the hashing algorithm ...
0
votes
0answers
40 views

Derive random output from payload & encryption key and verify it without knowing the payload

I want to know if this type of hashing or encryption scheme exists. Let's say there is a master key : 'abcdefg' I want to encrypt the payload : '2018-11-08 22:11:02' The output : '...
1
vote
1answer
44 views

preimage resistance [duplicate]

I'm struggling to get a clear understanding of second preimage resistance and collision resistance. Research on the internet yielded the following definitions: Second pre-image resistance Given an ...
2
votes
4answers
136 views

Is an authenticated server seeing the plaintext password a serious problem?

Typically a server ends up observing the plaintext password sent by a user at some points (correct me if it is not). Assuming that there is a secure channel established and the data are confidential, ...
1
vote
0answers
29 views

Rotating session names vs a static session name with a rotating validation string

I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon ...
1
vote
1answer
41 views

How to support search of data under PCI-DSS?

Suppose that the data in question is a card PAN. According to PCI-DSS, you have to store it with extra security (encrypt it before storing in database and store the secret key elsewhere with more ...
0
votes
0answers
37 views

Bots trying to spoof encoded email links, but why?

I've setup an application for my client, that sends lists of job vacancies to subscribers every Monday morning. The emails use a custom link redirector service, to make the links email friendly, and ...
2
votes
3answers
99 views

Is it possible to use “cryptographic hash function” for “digital signature”?

I understand that a cryptographic hash function is a function that generates a fixed size random string for an arbitrary input. However, is it possible to use a cryptographic hash function for ...
0
votes
0answers
61 views

How to mask attack a sha256 hash with following information using hashcat?

I am hashcat newbie and I want to crack a hash :) The answer is 1-15 (unknown) characters and it may contain 'a-z' 'A-Z' '0-9' and '_' . (A Twitter username) How may I mask attack a hash with above ...
0
votes
0answers
21 views

RADIUS authentication. Password hiding

From what I know, when a user wants to login to a RADIUS server, it sends their username and password to a NAS, and the NAS hides the password by hashing (MD5 (shared secret, request authenticator) ...
0
votes
0answers
32 views

Malware host-based signature [duplicate]

Wondering how anti-malware companies (especially those using signature based detection solution) create a signature for the malware or bad files. Do they just make a hash for the whole file? because ...
1
vote
2answers
75 views

Does a File's Checksum Change after it is Digitally Signed?

From my understanding, when you digitally sign a file, it changes that file's checksum because they are bundled together. Example of what I mean: file1.txt only contains the letter 'd' and the ...
0
votes
0answers
11 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
1
vote
4answers
205 views

Why should we protect access to password hashes?

Why should we protect the access to the password hashes? And under what conditions can this precaution be omitted?
1
vote
0answers
35 views

Increase password iterations?

Is it possible to strengthen the macOS login password by increasing the number of sha-512 iterations?
-1
votes
0answers
20 views

How to harden user/login password? [migrated]

In High Sierra or Mojave, is it possible to harden our login password so that the hash is more difficult to crack? I'm not a crypto person, but can we increase the iterations, transforms, hashing algo ...
0
votes
0answers
25 views

How to convert plutil output to hash? [closed]

I'm trying to convert my .plist into a hash. sudo defaults read /var/db/dslocal/nodes/Default/users/username.plist ShadowHashData|tr -dc 0-9a-f|xxd -r -p|plutil -convert xml1 - -o - How can I ...
1
vote
1answer
41 views

Ensuring key integrity

I have encrypted AES key stored in the database with the encrypted data. AES key is encrypted with a key derived from the passphrase. I want to ensure the integrity of the stored AES key. Is the ...
1
vote
1answer
51 views

How do Field Programmable Gate Arrays (FPGAs) compare to Graphics Processing Units (GPUs); for cracking hashes?

As a general rule, GPUs are more effective than CPUs when it comes to performing acutely repetitive tasks, like iterating over lists and generating permutations of a set (i.e. exhausting dictionaries &...
2
votes
1answer
56 views

Proof of information having been created before it is released

I have been thinking about the following use-case: some institution wants to organize bets about an outcome that is of its own choosing. The timeline is as follows: The organization chooses the ...
0
votes
1answer
52 views

Both Ophcrack and ONTP&RE incorrectly show Windows 10 passwords as blank

I'm trying to crack a Windows 10 laptop that I myself set a password on a day or so ago. So far I've tried booting into Ophcrack 3.6 and ONTP&RE (Offline NT Password & Registry Editor) from ...
5
votes
2answers
1k views

Why is SHA-256 not good for passwords? [duplicate]

I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 ...
2
votes
1answer
82 views

How to programatically verify a file signature?

I have a dll file signed with my private key, here is the signature info in Windows Explorer: Now, using the public key found in the certificate, how can I verify the integrity of the file? I am ...
0
votes
1answer
95 views

Does hashing a file consider its digital signature as well?

I have a signed (using Windows signtool) executable which is hashed by SHA1 algorithm and encrypted using RSA. Now I like to verify the executable to avoid security vulnerabilities. For that I have an ...
48
votes
3answers
5k views

What is the benefit of having a cryptographically secure hash algorithm in hashmaps?

I recently read the Rust language documentation and saw this: By default, HashMap uses a cryptographically secure hashing function that can provide resistance to Denial of Service (DoS) attacks. ...
1
vote
1answer
99 views

If someone has a hashed password, how long till they decrypt it?

Earlier my friend suggested that we have a race to see who could decrypt a hashed password first. I want to do it but I don't want it to be an all month thing. I know when passwords are hashed they ...
0
votes
0answers
39 views

rainbow-table which Reduction function is best or use both

Two Reduction function in rainbow-table known to me one = i H(P1) = X1, remove X1 remove all the value only left first few number Two - x mod N, mod method or Use both but if using both which which ...
2
votes
4answers
305 views

Do different files always have different MD5 or SHA1 hash codes?

My question is if different files always lead to different MD5 or SHA1 hash codes?
0
votes
1answer
52 views

Is any plaintext stored as a password hash an effective way to lock out an account?

I'm building a web app with Flask and I have user accounts that store their passwords in a MySQL String column using werkzeug.security's generate_password_hash() method. I wanted to create a Community ...
0
votes
0answers
54 views

Meaning of rtgen (rainbow table generation) parameters

I would like to generate some rainbow tables and try some password lookups as an exercise. I'm familiar with cracking hashes using a few expensive GPUs and hashcat, so I don't want that answer as an ...
2
votes
2answers
71 views

To build a rainbow table, how to decide size of chain and number of lines?

To be sure I well understood the Rainbow Tables, I've decided to make a little project in Java, but I"m stuck on a question : how to choose the size of the chain ? And this will give the number of ...
2
votes
3answers
187 views

Checksum vs. Hash: Differences and Similarities?

What are similarities and differences between a "checksum" algorithm and a "hash" function? Can they be used instead of each other? Or their usage are different? For example, for verifying the ...
0
votes
1answer
97 views

Same content different hash? [closed]

So I made a txt file using notepad and made a hash of it: SHA1: 701B6FAD6530C61528F9C11F024A9434B3C42D65 then I edited that file and took the hash again: SHA1: ...
1
vote
2answers
197 views

John the Riper couldn't crack all the passwoords

I have a password file with 7 passwords, but JTR only could crack 4 and 3 that couldn't. What it's the reason? C:\tmp\john179j5\run>john --show shadow.txt root:password:12923:0:99999:7::: student1:...
0
votes
1answer
84 views

Is AES + MAC more secure than encrypting plaintext along with its hash

Suppose I want to encrypt some plaintext and I can only use an unauthenticated AES mode like CBC. One way of adding authentication is encrypt-then-MAC, where the two different keys for AES and MAC ...
1
vote
1answer
102 views

Slow Hashing Without a Salt?

I'm trying to design a security scheme that involves a shared secret but isn't a traditional account password situation. The server would store a set of "keys", each of which has a blob of data ...
0
votes
0answers
65 views

How many unique MD5 hash values are there really? [duplicate]

The hashed value created by the MD5 hashing algorithm contains 32 chars, each of which contains 1 of 16 possible values. Simple math demonstrates that this could result in 16^32 number of ...
0
votes
1answer
70 views

Using AES encryption to generate MAC (and provide authentication/integrity)

Ignoring that there are far better and more standard approaches to providing authentication and integrity guarantees, what (if any) weaknesses would a system as outlined below that relies on AES (AES/...
0
votes
0answers
117 views

Extracting clear text password using Mimikatz and DCSync

I have a AD domain and the passwords are stored using the reversible encryption. I am using the Mimikatz tool with lsadump::dcsync /domain:xxx.com /user:<name> to retrieve the clear text ...
2
votes
1answer
39 views

Securely Download lubuntu from Non-Ubuntu System

The recommended way to find out which public key you need to verify the Ubuntu hashes is to attempt to check a signature of the hash file (both of which were downloaded in the clear). This produces an ...
0
votes
1answer
30 views

How can hash keys of downloadable binaries be useful if a website has been compromised? [duplicate]

Sometimes a website that has some binaries to download, also presents their hash keys, so that a user can verify the integrity of the binary. I suppose this is mainly for security reasons, not to ...
1
vote
2answers
55 views

Confusion about the software and also the digital signature getting modified

I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted ...
1
vote
1answer
72 views

Best practices to protect public/private SSH key pair in web interface?

I've got a dilemma here: I'm working on a system that will connect to remote linux servers for monitoring and automating some processes. Since user+pass is insecure for obvious reasons and public/...
7
votes
2answers
1k views

What could an attacker do if they gained access to PBKDF2 hashes?

This is regarding a web application where a user has to login with their personal email as the ID, and a password they have chosen personally. If an attacker somehow gained access to a credential ...
7
votes
1answer
475 views

In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?

There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
1
vote
1answer
122 views

How to increase the time for an offline password attack

I am trying to answer a CASP exam practice question. Could someone comment on the options below regarding the logic behind each item? Where is the logical error behind each statement? A Storage-...
0
votes
2answers
435 views

Is it possible to crack Joomla hash password?

I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash Joomla password which is (5aa154999c111bf7f33a1a3cadba5847) and I don't know the salt. is there any way to crack ...