Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
1
vote
2answers
60 views

Hash and data modification

If I have the MD5 and SHA1 hash matches for an encrypted container. Is there no possibility it's been modified? Is it safe to assume the container has never been modified?
6
votes
2answers
212 views

What is the best way to show a (long) number for comparison?

How to represent visually a number (like a key or hash) on a screen for visual comparison with another representation of that number on another screen (or another window) in such way that it would be ...
1
vote
1answer
70 views

Finding original command result from MD5 hash

Basically I hashed the result of the "date" command with md5sum: $date | md5sum The output is indeed in the likes of: e4c94362cd4fd71ec6aca78c7411bdc3 - My question was: is it possible to recover ...
19
votes
4answers
9k views

How long should a hash be to be absolutely secure?

Is there some sort of rule to determine how large a hash should be to ensure the security (meaning exactly one message maps to a given hash) of a message? Something that can be applied to any message,...
-1
votes
1answer
63 views

Calculating Time for a Attack on Password Hashes [closed]

Suppose I have a database containing hashes. Hashes are obtained from password developed from randomly chosen set of 94 characters such that each password size is of 8 characters. So we have 94^8 ...
-2
votes
0answers
27 views

Password Length and Key Length [duplicate]

Passwords are not stored in plain text. So we encrypt the password. But for encryption we have to use a key. Is there a issue if the password length and key length not same? (i.e. if we are using ...
3
votes
0answers
97 views

How to do client + server side hashing?

I don't want the password to be sent in clear text over the internet, even when using HTTPS the server admin can read the password if they somehow cache or log post requests. Now, what I have come ...
0
votes
1answer
95 views

should giving salt to unauthenticated users be a problem

Let's say i have a scenario when the user salt is required in client side before login, the user obtains the salt by this url http://my-api.example/get-salt/userid that url should return a salt for ...
3
votes
1answer
85 views

Is there an alternative to using hashing to identify malware?

I'm reading a sans paper on IOCs (indicators of compromise) in malware forensics and I came across this interesting obstacle: polymorphic and metamorphic codes (Paxson, 2011) result in multiple ...
0
votes
3answers
133 views

Providing password review results to auditors

The IT Security department is getting audited and the auditor had approached our IT Security team and requests to see results of the password review process, which compares existing database of ...
16
votes
10answers
10k views

Crack hashed passwords using a known password

I'm a dev trying to deploy a new dashboard I've written at work, the old one is a mess of hacked together libraries and only about half of the codebase is still even in use (dead code everywhere that ...
0
votes
1answer
78 views

What are the steps of hashing and steps of verifying password using salt and key? [duplicate]

What are the steps of hashing password during registration and login to an application using salt and key? Are the following steps considered correct if applied to an application?: 1- During ...
-3
votes
1answer
53 views

Digital Certificates, exhaustive set of their uses and references [closed]

I am a newbie of sorts as far as particulars of security is concerned.can somebody list all the possible uses of a digital certificate? it is used in SSL, signing and what else? Also is there a good ...
2
votes
1answer
88 views

How to configure .NET's PBKDF2 implementation (Rfc2898DeriveBytes) in 2019?

I want to use .NET's Rfc2898DeriveBytes functionality in order to store my passwords in a database. In order to use it, I still need to make several decisions which will influence the level of ...
2
votes
1answer
160 views

How to store a user's password in a database in 2019? [duplicate]

This question, but focused on .NET's given PBKDF2 implementation, has been asked here now. Situation I am currently updating a password storage mechanism for a website. My plan for storing a ...
1
vote
0answers
63 views

How can I maintain and automate a list of download URLs with known hashes? [closed]

I'm familiar with the concept of downloading a file and manually checking it against a published checksum. See How to verify the checksum of a downloaded file (pgp, sha, etc.)? and Is there a command ...
1
vote
1answer
94 views

Password hashing with salt. Where do you leave the salt? [duplicate]

I want to hash a set of sensitive data using a hash+salt. I've done a little research and now I know that: The salt should be random. The salt should not be reused. Using hashing without salt makes ...
0
votes
1answer
111 views

Is it secure to use a hash of a login token as an anti-csrf token?

Alright here is my proposal: Use a hash of a login token as the anti-CSRF token. Why this is a good idea? Prevents having to store anything extra on the client, the server, and less network traffic ...
6
votes
1answer
515 views

Securely displaying hidden integers with MD5

A system I'm studying uses the following mechanism: a 19-digit integer is hashed via the MD5 algorithm and the salt of the integer is shown in plain sight to the user before they take an irreversible ...
61
votes
4answers
11k views

Is Bcrypt a hashing algorithm or is my study material wrong?

I'm currently studying for my Comptia Security+ exam and on a practice test online I got this question: Or, represented as text: ▶ Which of the following are hashing algorithms? (Select all that ...
1
vote
0answers
95 views

Can I use Keycloak as a key store like Hashicorp Vault for an example? [closed]

Can I use Keycloak as a key store like Hashicorp Vault for an example? Keycloak has realm keys, can I use this feature as a secure key store and use it to encrypt and hash data in my web application? ...
4
votes
1answer
112 views

PBKDF2 doesn't seem to have a standardised implementation?

I recently read about the bug in Django with regards to PBKDF2 causing Denial of Service with large passwords: https://www.djangoproject.com/weblog/2013/sep/15/security/ This is because PBKDF2 "...
1
vote
5answers
189 views

Can I use a cryptographic hash function to prove my authorship of an anonymous article?

From what I understand, hash functions are one-way functions. Let's say that I want to publish an opinion article anonymously, but there is a possibility that I later want to prove that I was the one ...
0
votes
1answer
74 views

How should we apply the salt to the password? [duplicate]

According to Wikipedia: A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
0
votes
2answers
128 views

Why does php password_hash() generate different hashes for the same input? [duplicate]

I've been using password_hash('password', PASSWORD_DEFAULT) for an internal system, and while I was testing the code, I saw that it generated different hashes for the same input. Why does this ...
1
vote
1answer
82 views

JohnTheRipper Advanced Mask

I have problem to construct advanced mask to crack hash of 7zip file. The password have 16 chars where are all lower, upper, decimal and !@#$%-_=+: Main information is that any char can't duplicate ...
0
votes
2answers
49 views

Would verifying the integrity of my website by comparing digest on the client side work?

So today I read about the sub-resource integrity attribute feature for browsers. And I though of using the same concept to verify the integrity of my HTML to protect against tempering by my web host ...
1
vote
1answer
61 views

Does digested passwords send over a non encrypted channel offers additional security over plain text passwords?

I am learning about WS-Security and trying to compare different options offered by UsernameToken as described in this document. AFAIK, a digested password is a hash of the plain text password along ...
3
votes
1answer
57 views

Difference between linux hash sum utilities and online string to hash utilities

When I go online and calculate a hash from a string on some generator website, no matter the algorithm or the website, it is always a different output than if I do echo "password" | sha256sum (or ...
0
votes
1answer
129 views

I don't know how to identify the method behind the hash [closed]

I found online an web app that is vulnerable to blind sql injection, I manage to get in users table and I looked at my password, in the table was the hased version, this one->57b0fcbe39b9336d, now I ...
0
votes
1answer
123 views

Security concept for password management

At the moment, I am struggling on a question to which I have not found a good answer so far. I wan't to create a password manager, which will be used by a lot of people. Used languages: PHP / ...
1
vote
4answers
281 views

Is it possible to create an executable file by hashing a different file?

Theoretically, is it possible to hash an executable file and have the output hash end up being another executable file? I know the chances of this are unimaginably small, but I'm curious.
0
votes
2answers
53 views

Oauth2 PKCE - What security does “S256” provide over “plain”?

The Oauth PKCE protocol flow is as follows, as defined in RFC 7636: +-------------------+ | Authz Server ...
1
vote
1answer
174 views

Tools to produce an MD5 collision?

I'd like to learn a bit more about MD5 collisions. So let's assume I have a message m: m = somesecretmessage And I hash that message: z = md5(m) The only know information is z. I do not know m. ...
6
votes
1answer
213 views

Detect duplicates without exposing underlying data

We have a scenario where we need to prevent two users from using the same identifier. The identifier is sensitive (e.g. a social security number), so we do not want to store it in our DB. We just want ...
1
vote
1answer
153 views

Is there a unique way to identify a hardware?

I'm considering an environment in which I will have to identify a computer. In this scenario all hardware parts (CPU, HDDs, RAM, etc) won't change, while I'd like to consider a changing OS. The goal ...
8
votes
2answers
3k views

How to generate short fixed length cryptographic hashes?

I am trying to implement a kind of email verification system with a node.js server with no state. The strategy User sends his email to the server Server generates a 4 digits code based on the email ...
0
votes
0answers
42 views

Is Argon2 secure to use? [duplicate]

Now that it's been 5 years since Argon2 has been released, is Argon2 secure for public use? (E.g. normal password hashing) Also, what are the secure parameters for Argon2?
0
votes
1answer
487 views

Can I crack a zip file using Hash Suite on Windows?

I'm trying to crack a password I set on a zip file using Hash Suite but it doesn't seem to work for me (not sure if I'm doing everything correctly). Basically, this is what I've done: Created a ...
2
votes
1answer
157 views

Has scrypt gone through enough testing to be considered secure?

Five years ago, an extremely similar question was asked: has scrypt withstood the test of time. Since this was asked five years ago and some of the responses were mixed, such as: "Scrypt has mostly ...
0
votes
0answers
34 views

Is this implementation of a bcrypt EtM flawed?

I know that you should never roll your own crypto, but I'm just implementing/combining(?) two highly trusted algorithms into Javascript First, I am using a bcrypt implementation that I did not code. ...
34
votes
3answers
5k views

Which is the best password hashing algorithm in .NET Core?

What are the considerations when picking the best password hashing algorithm in .NET Core? I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
3
votes
3answers
177 views

Is a Whirlpool hash with random salt secure enough?

I copied the title from another question, but it wasn't answered there and my case is a bit different. I have inherited an old website to maintain. I noticed that the password hashing is not up to ...
2
votes
2answers
104 views

Am I using RfcDeriveBytes correctly, when the salt I'm providing it contains the password?

I'm using Rfc2898DeriveBytes in my application to encrypt a password with a randomly generated salt, and with a set iterator count for slowness. Before, I just grabbed the generated salt and put it ...
5
votes
3answers
2k views

Why are non-collision-resistant hash functions considered insecure for signing self-generated information

Let we have a hash function that is second preimage resistant but not collision-resistant. Then an adversary can create a pair of different messages M and M', M is benign and M' is malicious, for ...
0
votes
1answer
68 views

How can I apply message digest to the application so that user can validate the accuracy and completeness of the software [closed]

I have developed the application and now it's time to distribute to my users. I was reviewing my application and reading security best practises and found below statement in one of the article. ...
2
votes
0answers
168 views

How does Veracrypt work?

I’m a layman in security and was trying to understand how hashes and encryption algorithms are used in Veracrypt/Truecrypt. Reading the documentation, this is what I understood (please, feel free to ...
1
vote
3answers
165 views

Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?

Under GDPR, IP addresses are personal data. I have no need to trace back IP to specific users, but I would like to limit downloads to one per IP.* I do not want to store plain IPs. My first solution ...
0
votes
1answer
119 views

is possible someone break the algorythm of my dice game with hashes

I just want to know how much secure are these games. I coded my own game and now want to know how much secure is. If for example the hash is visible(before you bet) would be possible decipher this ...
0
votes
0answers
51 views

Is client-side password hashing still useful when using TLS? Is TLS crackable? What about PFS? [duplicate]

Is client-side password hashing still necessary / useful when using TLS? What about TLS protocols with PFS (perfect forward secrecy) like Diffie-Hellman? Let’s say that I’m running a web application ...