Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
2 votes
2 answers
49 views

How can a users plaintext password be acquired while using biometricID with the following security model?

This is a slightly tough one to explain with my current experience, lacking mainstream terminology. But here goes. I have an encryption/security model whereby I do not store users plaintext passwords. ...
  • 149
1 vote
1 answer
69 views

Why can we not store all hash results in a database and look them up?

When somebody wants to find out a password by using its hash, he can use for example John the Ripper. Then he runs the application for days or weeks or years, hoping to somewhen guess the right result....
  • 141
0 votes
0 answers
44 views

KDF vs hash function in loop for hashing password

I'm trying to grasp which benefit can KDF like PBKDF2, scrypt and bcrypt (I know that bcrypt is technically not KDF) may bring over hashing in loop like sha256sum(sha256sum(sha256sum.....(salt + ...
19 votes
5 answers
4k views

What is the name of this concept involving hashes?

I'm looking for the name of a concept that works as follows: I post a hash of a file publically e.g. on Twitter Whenever needed, I provide the file with the contents that make up the given hash The ...
1 vote
2 answers
64 views

Random identifier vs identifier plus HMAC

Suppose I have a resource that I want to be accessible only using a specific link. I could generate a link using a 256 bit random identifier, e.g. https://example.com/aMXtSQufIxntoMSnTQGdgMfs84VzM-...
0 votes
0 answers
66 views

John The Ripper: dynamic format with CRC32 and Salt

I was trying to use the following format with John: john --format=dynamic='crc32($p.$s)' --wordlist=/usr/share/wordlists/rockyou.txt hash.txt "Error: dynamic hash must start with md4/md5/sha1 ...
0 votes
0 answers
42 views

What should argon2id parameters be

I plan to use it locally on mobile devices. These seems to do not offer computational power as good as on a server. So what could be a secure argon2id parameters that run around 1s since offline apps ...
0 votes
0 answers
37 views

On the gains and losses of an additional client side stretching of the user password [duplicate]

Picture a state of the art implementation of a website registration and login system. I'm interested in analyzing what a defender gains and loses by feeding the user password to a key-stretching KDF ...
0 votes
1 answer
56 views

Key derivation for HMAC, concatenate vs multiple HMAC passes

I'm trying to build a generic function to encrypt HMAC values with a single global secret key, but that can be "scoped" or salted by application/uses. For instance, an HMAC for a session ...
0 votes
2 answers
66 views

Using hash to search encrypted records

If I am using SHA-512 hash values merely as a means to search fields that have been encrypted elsewhere, is it cryptographically secure enough to hash without salt? For background, I have been given a ...
0 votes
0 answers
41 views

john the ripper not not loading hashes

I created an unshadowed file to run through john, it worked fine. I created some additional users and created a new file with those hashes in there. I run john and get Using default input encoding: ...
  • 1
0 votes
0 answers
33 views

Does having the hash make it easier to crack the password than not having the hash? [duplicate]

For example, a password hash is: edgjcgo4866864rfhobd38790g764hkp Does having the hash of the password make it easier for the attacker to crack the password than not having the hash? If yes, why does ...
0 votes
1 answer
126 views

Using two different random numbers instead of RSA Keys

Binance public API supports access to specific operations with RSA key pair. Firstly customer generates an RSA key pair. The customer uses the secret key to hash(SHA256) the query string parameters ...
2 votes
1 answer
161 views

Is any client-sided password just security by obscurity?

Let's say I want to deploy a simple static website (with no backend server) with some protected pages only visible after entering a password. I could write a hardcoded salted hashed password and ...
  • 123
0 votes
1 answer
116 views

Why is it not possible to override password hashes

I know that a password is stored as a hash, because then it is not possible to get the password even if you have access to the password database/file/... But if you have access, couldn't you just ...
0 votes
0 answers
160 views

Best practices for storing passwords for PHP and MySQL applications [duplicate]

I am creating a simplified lead and call management system for a friend's small business. I would like to know the best practices for hardening password storage and verification using PHP 7.4 and ...
1 vote
2 answers
194 views

Is a very long and random password theoretically immune to password cracking?

Suppose a password’s stored hash is exposed in a theoretical mass security breach of a popular service given the following assumptions: The password is very long (30+ characters) The password uses a ...
0 votes
0 answers
29 views

Asymmetrical scheme: insecurity concerns of saving a hash of a hash of a password

please verify or explain how to do this properly. I'm letting a user create keys from the client through a secure server. I ask the user for a password on the client, then send the hashed password to ...
  • 103
3 votes
1 answer
90 views

Why are key IDs typically the *last* digits of the key hash?

With PGP for example, the "properties" of the following key are: pub rsa3072/2BD6571B 2022-06-03 [SC] [expires: 2024-06-02] 6713B62DC36CE36403C724B1FFD641CF2BD6571B uid [...
  • 33
0 votes
1 answer
86 views

Hashing email addresses using scrypt

I want to hash email addresses so that they are anonymous but still unique in my database. I was thinking of using scrypt for this and creating the salt as a sha256 of some secret stored on the server ...
  • 195
0 votes
0 answers
15 views

Can I store subject from a JWT from an external auth server in my DB?

We are retrieving external users using OpenID with the PKCE flow. We are using the JWT returned from the auth server to authenticate the user. If it is valid, we extract the subject field from the ...
  • 101
0 votes
1 answer
142 views

Is this 36 character long string a hash [closed]

I found this string b2335332-d28f-449b-8d00-80a550b43046 Do you think it´s a hash? If yes any idea which one and if not any other ideas what it could be?
1 vote
1 answer
126 views

Good checksum algorithm for backup / cloud sync system

I am writing a cloud backup system, and want to use a checksum to know if a file has been modified, and accordingly sync it with the server. This question shows that xxHash is super fast, and this ...
  • 113
1 vote
1 answer
111 views

Do we know a MD5 collision exploiting PHP loose type comparision (0123e2 == 123e02 == 012300)?

Since PHP has loose type comparison, we have: php -r 'var_dump("1234e03"=="1234000");' bool(true) And since MD5 hashs are often reprensented as hexa string like ...
  • 1,331
8 votes
3 answers
4k views

Argon2 vs SHA-512, what's better in my case?

First I am very bad in cryptographic algorithms. I found online that Argon2 is more secure than SHA-512, so I used it for password hashing. There're recommended options for Argon2: Memory: 4Gb ...
1 vote
1 answer
112 views

Potential problems with insecure password hashing

For my job I use some industry-specific software that stores sensitive information. The software has a web interface with a public login page. One time I attempted to log in, but mistyped the last few ...
17 votes
4 answers
3k views

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work? Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum ...
  • 181
1 vote
2 answers
182 views

Is there a relationship between the size of RSA key and size of hash function?

I have seen that for RSA2K the hash function SHA-256 has been used. Now my question is if I want to use RSA3K, should I change the size of the hash function for example from SHA-256 to SHA-384? Is ...
  • 113
0 votes
0 answers
33 views

What are the underlying mechanics that make password salting an effective deterrent against Rainbow Tables? [duplicate]

I have a top level familiarity with Rainbow tables (1 ,2 ) I also understand that salting adds a randomly generated alphanumeric string to each password before it gets hashed and put in a database. My ...
1 vote
1 answer
112 views

Why is this trusted .exe not showing up as signed in Virustotal?

So I was about to install Battle.net Desktop App to play some World of Warcraft. Downloaded from the official Blizzard.com website. (https://www.blizzard.com/en-us/apps/battle.net/desktop) Just out of ...
2 votes
1 answer
115 views

If multiple of the same password have the same hashed value in a database, does that mean the password is not being salted?

I just started a new job last week and I'm asking for a sanity-check before I mention this to anyone. All the new employee accounts are created with the same default password (I know, already a no-no)....
7 votes
2 answers
2k views

Can you use an FPGA with hashcat?

Hashcat list FPGAs as OpenCL device type in its help. - [ OpenCL Device Types ] - # | Device Type ===+============= 1 | CPU 2 | GPU 3 | FPGA, DSP, Co-Processor So can you really somehow connect and ...
7 votes
6 answers
5k views

What's the point of hashing a password and then sending it to the server?

If the password is hashed and then sent to the server where the hash is compared to the stored hash, this basically means that if someone had that hash they can still log in by sending the hash in the ...
3 votes
1 answer
87 views

Hashing to protect privacy

I like to know if hashing protects privacy enough, i.e., if a hash of PII is still considered to be personally identifying information (PII). I found this article: https://www.johndcook.com/blog/2019/...
  • 31
4 votes
1 answer
524 views

Actual definition of a Message Digest?

I'm having a hard time to find a clear and definitive definition of what a Message Digest is in regards to hashing algorithms. Some sources state it's the hashing function itself. Other sources state ...
  • 143
1 vote
3 answers
200 views

Proving that a file existed at a time

How do I acquire the means to prove in the future that I had possission of a file now, without relying on the integrity of a single entity? (I believe one way of doing it would be to put the file ...
1 vote
0 answers
20 views

Can I trust a hash commit for integrity of the entire repository? [duplicate]

Sometimes there's no tar release for some repo in github, and the download as zip button only generates a random zip with random hash. So, in my Dockerfile, I want to clone a repo but be able to check ...
0 votes
1 answer
269 views

Hashcat brute force - markov chains

Hashcat uses Markov chains by default when using brute force mode. Do they really speed up the cracking since a randomly generated password normally has the same probability for every combination?
0 votes
0 answers
51 views

How is a TLS certificate authenticated, down to a code level? [duplicate]

I am having trouble to understand how a TLS certificate is authenticated. From what I read, a server's leaf certificate contains: Server domain name Server public key Issuer (CA) domain name Issuer (...
  • 101
0 votes
2 answers
73 views

Design for deleting users accounts, yet knowing when they register again

My webapp takes in email addresses as user names at registration, verifies ownership by sending emails with confirmation links, etc. I'm now looking for a secure design of a user deletion feature, ...
0 votes
0 answers
45 views

Certificate encryption and hash algorithm [duplicate]

I was creating self-signed certificate with OpenSSL and had to choose encryption and hash algorithm. Are those algorithms used for encryption between client and a server? If not, then what are these ...
  • 1
7 votes
1 answer
677 views

How can a .exe be modified and still keep a valid digital signature?

When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true. ...
0 votes
1 answer
87 views

How to securely hash sensitive data and make the hash public, while preventing an attack by someone who know the structure or some part of the data?

In a nutshell, I need: to hash a file and to make this hash public, to be able to prove data integrity when sharing the data privately with a trusted third party. to choose the right hashing method ...
  • 3
0 votes
1 answer
103 views

Hash collisions in password history

When a user changes password, I'd like to implement a simple check that prevents them from reusing the same password. If the new password matches the old password, reject with an error. Sounds easy, ...
  • 1,280
0 votes
0 answers
112 views

Why we need complicate truncation for the OTP?

If we assume that Time based OTP generates the OTP using the hash function like SHA-3. Then, the generated OTP would Hash(Secret, Shared time). We want a shortened string rather than a full hash ...
1 vote
3 answers
198 views

AES Encryption vs hash function with the strong assumption of input size and secure key?

There are plenty of questions about the difference between AES encryption and hash functions. I read some of them and the general answer is that AES is reversible as long as the key is exposed. AES ...
  • 11
0 votes
1 answer
165 views

HMAC SHA256 by using a static key + text as a key

Maybe it's not a good idea, but I would like to check it with you. When using HMAC SHA to hash a clear text value (string max 30 char) I need to use a key (256) but in my scenario this key is static ...
0 votes
0 answers
53 views

Can I find the private key on an old Android Wallet's source code?

I recently found an old wallet from my younger self with God-knows what kind of embarrassing data on it. I only found the back up files on a cloud service and did some digging as to what it was when ...
0 votes
0 answers
56 views

Are hashed passwords transferred to a server for user authentication? [duplicate]

A question I came up with while reading in my information security class. Let's say website ABC which uses username and password combinations to authenticate users and has a user John. When John goes ...
  • 1
0 votes
1 answer
76 views

Verify password before decrypting data

I need to verify a password before decrypting the data. My encrypted data is too big and waiting to see if the authentication tag is correct is out of the question. I’m using Argon2id as my KDF. My ...

1
2 3 4 5
45