Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
4answers
116 views

Why can't you use the same password for every site, if they are hashed on the site?

I've often heard people talking about not using the same password on every website. What's the deal if servers store passwords in a SHA hash instead of plain text? The most they can do is spam you ...
0
votes
1answer
28 views

How to sign multiple data sets with a single signature, so that it can be validated for single data set without requiring the rest of the data?

Let's say Alice has three secrets: SecretA, SecretB, SecretC Alice shows these three secrets to Bob and gets a single signature from him that signs all three secrets together. Something like Signature ...
0
votes
1answer
205 views

John the ripper - ecryptfs - sample not cracked: 0 password hashes cracked

I tried to use john the ripper on the sample : ecryptfs_sample_metadata.tar (password is 'openwall') Which I downloaded from here: https://openwall.info/wiki/john/sample-non-hashes If i try sudo ...
0
votes
1answer
51 views

dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?

I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt. I want to confirm some of my understandings: Salt is automatically generated by cyrptsetup with ...
41
votes
15answers
8k views

Why do people think that this is bad way to hash passwords?

What's wrong with this code? $password = "hello"; $password = md5($password); for ($i = 1; $i < 20; $i++) { $password = md5($password); } I don't think an attacker with access to the ...
0
votes
1answer
118 views

John the Ripper / Hashcat rule, reject candidate if char at position X is the same as character at position Y

I'm using John to generate some word lists and I'm trying to figure out the most optimized way to do the next step. What I want to do is add ever possible 3 digit number to a set where the first digit ...
2
votes
1answer
730 views

How do Field Programmable Gate Arrays (FPGAs) compare to Graphics Processing Units (GPUs); for cracking hashes?

As a general rule, GPUs are more effective than CPUs when it comes to performing acutely repetitive tasks, like iterating over lists and generating permutations of a set (i.e. exhausting dictionaries &...
1
vote
1answer
247 views

How to securely store decryptable passwords

I'll quickly outline the purpose of our application: The user logs in using his username and password. He will receive a list of servers he can connect to. After choosing a server the connection to ...
44
votes
6answers
60k views

Most secure password hash algorithm(s)?

What is/are currently the most cryptographically secure hashing algorithm(s)? (available in PHP) Speed is irrelevant, because I'm iterating the hash over a fixed time (rather than a fixed number of ...
2
votes
0answers
41 views

Why does firebase encrypt with password hashes instead of storing the hashes?

I am trying to migrate off of firebase, as in doing so, you can export the hashes of user passwords. Looking at their algorithm, they do not store password hashes, but rather, they use the first 32-...
0
votes
1answer
47 views

OpenSSL: how to get matching subject_hash from a CMS SignerInfo?

So OpenSSL can calculate a hash value for X509 certificates that uniquely identifies this certificate: https://www.openssl.org/docs/man1.0.2/man1/x509.html (argument -hash or -subject_hash) now, if I ...
1
vote
1answer
105 views

Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?

To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
9
votes
4answers
2k views

Is it good practice to SHA512 passwords prior to passing them to bcrypt?

I want to allow any-sized passwords to be allowed to be submitted. I currently use bcrypt as a key derivation function for passwords, however I have realized that it has a maximum input length of 72. ...
44
votes
8answers
30k views

Hashing a credit card number for use as a fingerprint

What's the best way to hash a credit card number so that it can be used for fingerprinting (i.e. so that comparing two hashes will let you know if the card numbers match or not)? Ideally, I'm looking ...
0
votes
2answers
317 views

Save private key in a database to share between multiple accounts

I don't know if my concept would be secure so I ask here. The main purpose is to log in with password x and also use that password to encrypt an RSA private key with AES to store that in the main ...
0
votes
1answer
239 views

Directly signing a file with gpg or instead its checksum file?

It is my understanding that when file is signed with gpg the signature will provide 2 guarantees, a proof of ownership of the signature and the integrity of the signed data. lets say I have a doc.txt ...
0
votes
1answer
59 views

Sending and blocking emails from hashed and salted address ? (for GDPR)

I would like to send emails from a server, but also make them unable to trace for me as server owner or attackers. I want this for GDPR but also to protect people from abusers. Short info about ...
6
votes
1answer
133 views

For bcrypt why is JTR so much faster than hashcat?

To keep it short I've recently been learning about hashing and password hash cracking on TryHackMe. I was tasked to crack the following hash: $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V....
0
votes
2answers
6k views

which hash algorithm takes longer time if we compare between md5 or sha256?

Which hash algorithm takes longer time to compute if we compare between md5 and sha256? I do not want to use it for security reasons so I do not care about which one is more secure, I just want to ...
1
vote
1answer
3k views

Understanding ANSI/AAMVA encoded data (pdf417 data matrix) on back of NYS ID card

Background I am developing an Android application for work which runs on a Zebra TC51 bar code scanner, which I have been playing around with.. I scanned my NYS drivers license and inspected the ...
4
votes
2answers
2k views

Is there a good 160 bit alternative for SHA-1?

SHA-1 has long been considered insecure, and now the attacks have been demonstrated in practice also. The proposed alternative for SSL certificates is the SHA-2 suite of hash functions, of which SHA-...
0
votes
1answer
46 views

Config file contains password hashes and signature keys

First, I am a beginner in IT security. I hope my question is not too dumb. I use a program that can show a live feed from a security camera. You can import a project file, that sets up user accounts ...
2
votes
1answer
130 views

John The Ripper Error: No password hashes loaded when cracking a zip file in kali linux

I was practicing bruteforce attacks using John The Ripper. I want to crack a zip file. I obtained the hash and stored it in a zip file but when I attempt to crack the zip file it is giving me an error ...
3
votes
1answer
2k views

Are there any known MD5 hash collisions of messages of different length?

All the examples of MD5 hash collisions I've come across comprise two different messages (inputs) of the same length. The first and second messages have different values for a number of bits and the ...
3
votes
2answers
91 views

Why should I go to SHA512withRSA signature for my Android apps?

I have an Android 11 device and many of my apps and system apps use MD5withRSA or SHA1withRSA as signature algorithm by default. Why should I take my apps SHA256withRSA or SHA512withRSA? Are there any ...
1
vote
1answer
68 views

Why the need to hardcode passwords? [closed]

Many IOT devices and routers manufacturers hardcode plaintext default passwords in their devices. Why don't they store the hashed password instead? For what functionality do they need the plaintext ...
5
votes
1answer
614 views

Safety of barcode checksums

A company is handing out gift vouchers with a unique code128 barcode. The barcode consist of 12 fixed characters containing meta information and sequence number plus a 4 digit checksum. For example: ...
1
vote
2answers
122 views

Why don't companies just tie the password to the user name?

One problem with passwords is that if they can be broken as follows: pick a random password hash it compare that hash to other known hashes This way, you have broken the password. Then if you can ...
0
votes
1answer
54 views

What is the relation between “signature_algorithms” handshake extension and TLS ciphersuite

I am learning TLS handshake and find client/serve will negotiate a cihpersuite during client/server hello. Usually, the last part of a ciphersuite is a hash algorithm, like SHA256 in ECDHE-ECDSA-...
0
votes
3answers
100 views

How to verify integrity of software when the download provider doesn't publish hashes?

I noticed that certain software does not provide hash anymore nowadays. E.g. Zoom https://zoom.us/download wolf@linux:~$ ls -lh zoom_amd64.deb -rw-rw-r-- 1 wolf wolf 44M Jan 1 00:00 zoom_amd64....
22
votes
8answers
2k views

Is a simple, but very long password a good password?

Is a password like wwwwwwwwwwwwwwwwwwwwwwwww9 (25x 'w' and a number) secure? It would be easy to remember.
56
votes
5answers
14k views

Is it secure to use MD5 to verify the integrity of small files (less than 15kb)?

I know that collision for MD5 has been documented since the 90s and that digital certificates based off of MD5 has been demonstrated to be completely compromised back in 2010 but how effective is MD5 ...
8
votes
7answers
5k views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
1
vote
2answers
53 views

Enpoint protection: How to search an organisation for hash value

As part of incident response to malicious code outbreak and given the hash value of the malicious artifact, I would like to search across the entire organization for this specific hash value. Do you ...
0
votes
1answer
58 views

How password_hash / password_verify can work with any arguments (PHP)

I already know how to use password_verify and password_hash functions, but I don't really understand how they work. When I use them I do something like that: $save_hash = password_hash( $password, ...
1
vote
2answers
662 views

What if the Local Windows Cert Store is Compromised?

The diagram below illustrates chaining digital certificates up to a publicly trusted Root Certificate: (source: globalsign.com) I have been researching how trusted root authorities (such as ...
2
votes
1answer
92 views

Can Hash Length Extension attacks be avoided by changing the data structure?

I read about Hash Length Extension attacks here and here. From the articles I gained that this attack relies on the data structure, in the way that the secret has to be prefixed to the data (please ...
0
votes
1answer
42 views

How to identify this hashed text and if it encrypted using a key? [duplicate]

I have 2 hashes which I don't remember which type of encryption I used or if i used a secret key. can you help me identify these I will just give all details but not paste the whole hash here. hash1 ...
7
votes
1answer
866 views

What are the minimum parameters for Argon2?

Argon2 is the winner of the Password Hashing competition, and currently recommended by OWASP for secure storage of passwords. One crucial step of Argon2 is determining the parameters used by the ...
1
vote
0answers
59 views

Which config files in a linux install contain passwords or other secrets? [closed]

I'm trying to build a list of configuration files that store secrets in Linux. By secrets I mean files that contains passwords, database string connection, hashes etc. The most notable example is, of ...
0
votes
0answers
24 views

How to assess security of Argon2 parameters [duplicate]

I would like to hash user password with Argon2id, then use this hash as ECDSA private key. I made some tests with Python and passlib.hash and found following parameters: memory: 32 MB iterations: 100 ...
25
votes
13answers
8k views

How are hashing algorithms useful if the implementation is public?

I may be misunderstanding, but if I want to use a hashing algorithm such as argon2, what's stopping from someone seeing how it works and reversing what it does?
1
vote
1answer
453 views

Postfix + MySQL ENCRYPT() encryption method change

I already have my mail server (postfix, courier, mysql) and roundcube as my webmail client, Encrypt() is the current password encryption function, Is there a way to change the default password ...
6
votes
1answer
30k views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? ...
0
votes
2answers
147 views

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here, the hashsum are made part ...
2
votes
1answer
65 views

one-way hash with PhP onto MySQL database (NOT for password)

My users (researchers) will be storing where their website is on a mysql database on my server. Ideally I want to hash the locations so that when the researchers' participants submit their data to my ...
2
votes
1answer
98 views

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
0
votes
1answer
32 views

Generating tokens via PRNG and Hashing

We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it Step 1: Generate a random number using a good a CSPRNG ...
8
votes
4answers
2k views

Alternatives for sending plaintext password while login

Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
2
votes
1answer
71 views

how message authentication code share keys?

How are secret keys shared between receiver and sender, especially when we want to have confidentiality that sender and receiver are using two keys, one for MAC algorithm and one for encryption and ...

1
2 3 4 5
42