Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
53
votes
4answers
9k views

Is Bcrypt a hashing algorithm or is my study material wrong?

I'm currently studying for my Comptia Security+ exam and on a practice test online I got this question: Or, represented as text: ▶ Which of the following are hashing algorithms? (Select all that ...
0
votes
1answer
56 views

Is it secure to use a hash of a login token as an anti-csrf token?

Alright here is my proposal: Use a hash of a login token as the anti-CSRF token. Why this is a good idea? Prevents having to store anything extra on the client, the server, and less network traffic ...
5
votes
1answer
373 views

Securely displaying hidden integers with MD5

A system I'm trying to disprove security of uses the following mechanism: a 19-digit integer is hashed via the MD5 algorithm and the salt of the integer is shown in plain sight to the user before they ...
86
votes
7answers
90k views

Is MD5 considered insecure?

After all these articles circulating online about md5 exploits, I am considering switching to another hash algorithm. As far as I know it's always been the algorithm of choice among numerous DBAs. Is ...
22
votes
8answers
6k views

How can I re-use my password and still protect the password if it is exposed from one source?

I know that all servers should at least store my credentials as hash(password + salt) + salt, with a secure and well known hash function and a salt unique for me, generated from a secure and well ...
3
votes
1answer
84 views

PBKDF2 doesn't seem to have a standardised implementation?

I recently read about the bug in Django with regards to PBKDF2 causing Denial of Service with large passwords: https://www.djangoproject.com/weblog/2013/sep/15/security/ This is because PBKDF2 "...
1
vote
5answers
174 views

Can I use a cryptographic hash function to prove my authorship of an anonymous article?

From what I understand, hash functions are one-way functions. Let's say that I want to publish an opinion article anonymously, but there is a possibility that I later want to prove that I was the one ...
1
vote
0answers
24 views

Can I use Keycloak as a key store like Hashicorp Vault for an example? [on hold]

Can I use Keycloak as a key store like Hashicorp Vault for an example? Keycloak has realm keys, can I use this feature as a secure key store and use it to encrypt and hash data in my web application? ...
0
votes
1answer
62 views

How are these transaction fingerprints colored?

For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
3
votes
3answers
1k views

Is there a good 160 bit alternative for SHA-1?

SHA-1 has long been considered insecure, and now the attacks have been demonstrated in practice also. The proposed alternative for SSL certificates is the SHA-2 suite of hash functions, of which SHA-...
0
votes
1answer
62 views

How should we apply the salt to the password? [duplicate]

According to Wikipedia: A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
1
vote
1answer
69 views

JohnTheRipper Advanced Mask

I have problem to construct advanced mask to crack hash of 7zip file. The password have 16 chars where are all lower, upper, decimal and !@#$%-_=+: Main information is that any char can't duplicate ...
0
votes
2answers
89 views

Why does php password_hash() generate different hashes for the same input? [duplicate]

I've been using password_hash('password', PASSWORD_DEFAULT) for an internal system, and while I was testing the code, I saw that it generated different hashes for the same input. Why does this ...
16
votes
3answers
34k views

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Maybe I have been negligent towards the verification of software I download over the Internet, but I (or anybody I ever met) have never tried to verify the checksum of the contents I download. And ...
1
vote
1answer
122 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
0
votes
2answers
47 views

Would verifying the integrity of my website by comparing digest on the client side work?

So today I read about the sub-resource integrity attribute feature for browsers. And I though of using the same concept to verify the integrity of my HTML to protect against tempering by my web host ...
1
vote
1answer
57 views

Does digested passwords send over a non encrypted channel offers additional security over plain text passwords?

I am learning about WS-Security and trying to compare different options offered by UsernameToken as described in this document. AFAIK, a digested password is a hash of the plain text password along ...
3
votes
1answer
52 views

Difference between linux hash sum utilities and online string to hash utilities

When I go online and calculate a hash from a string on some generator website, no matter the algorithm or the website, it is always a different output than if I do echo "password" | sha256sum (or ...
0
votes
2answers
47 views

Oauth2 PKCE - What security does “S256” provide over “plain”?

The Oauth PKCE protocol flow is as follows, as defined in RFC 7636: +-------------------+ | Authz Server ...
1
vote
4answers
2k views

Can hashing a file alter the file?

Is a hash function a Random Oracle(RO) function or will there be a chance that the hash function will alter the file (as part of function or by accident) that it is hashing?
0
votes
1answer
110 views

I don't know how to identify the method behind the hash [closed]

I found online an web app that is vulnerable to blind sql injection, I manage to get in users table and I looked at my password, in the table was the hased version, this one->57b0fcbe39b9336d, now I ...
0
votes
1answer
112 views

Security concept for password management

At the moment, I am struggling on a question to which I have not found a good answer so far. I wan't to create a password manager, which will be used by a lot of people. Used languages: PHP / ...
1
vote
4answers
245 views

Is it possible to create an executable file by hashing a different file?

Theoretically, is it possible to hash an executable file and have the output hash end up being another executable file? I know the chances of this are unimaginably small, but I'm curious.
1
vote
1answer
108 views

Schemes for ID obfuscation like Facebook app scoped IDs

After certain privacy concerns Facebook rolled out a bunch of changes to their APIs, one being "scoping" user identifiers per app. In effect, this means that Alice's canonical facebook user ID is ...
1
vote
1answer
142 views

Tools to produce an MD5 collision?

I'd like to learn a bit more about MD5 collisions. So let's assume I have a message m: m = somesecretmessage And I hash that message: z = md5(m) The only know information is z. I do not know m. ...
0
votes
1answer
2k views

Reverse engineering server seed

$server_seed = "2754f7cc9e9e243711448401ea9d483067138a6b37c70c5d80b6c59943aa6996"; $lotto = "1135567382"; $round_id = "1"; $hash = hash("sha256", $server_seed . "-" . $lotto . "-" . $round_id); $...
0
votes
1answer
187 views

Can I crack a zip file using Hash Suite on Windows?

I'm trying to crack a password I set on a zip file using Hash Suite but it doesn't seem to work for me (not sure if I'm doing everything correctly). Basically, this is what I've done: Created a ...
14
votes
3answers
73k views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
0
votes
2answers
532 views

Generating multi-word passphrases from a wordlist [closed]

As part of pentesting NT hashes where the underlying passwords are minimum 16 characters of length, I have created a wordlist of common words, sports teams, movies, names, years etc. - inspired by the ...
5
votes
1answer
207 views

Detect duplicates without exposing underlying data

We have a scenario where we need to prevent two users from using the same identifier. The identifier is sensitive (e.g. a social security number), so we do not want to store it in our DB. We just want ...
8
votes
2answers
3k views

How to generate short fixed length cryptographic hashes?

I am trying to implement a kind of email verification system with a node.js server with no state. The strategy User sends his email to the server Server generates a 4 digits code based on the email ...
0
votes
0answers
37 views

Swift HMAC doesn't match NodeJS HMAC, but only sometimes! [migrated]

I have discovered a HUGE issue in my code, and I have literally no idea what is causing this. SO, when I send requests to my server I hash a string thats in the request. This is sometimes user input....
0
votes
0answers
37 views

How to implement token based authentication for my API? [migrated]

I have a Django backend which will be served as my API endpoints. Users are identified by username and password and have some extra information and should be able to consume my same API, so I want to ...
1
vote
1answer
147 views

Is there a unique way to identify a hardware?

I'm considering an environment in which I will have to identify a computer. In this scenario all hardware parts (CPU, HDDs, RAM, etc) won't change, while I'd like to consider a changing OS. The goal ...
0
votes
0answers
35 views

Is Argon2 secure to use? [duplicate]

Now that it's been 5 years since Argon2 has been released, is Argon2 secure for public use? (E.g. normal password hashing) Also, what are the secure parameters for Argon2?
0
votes
1answer
130 views

Proper way to verify keycard integrity

I have thought about building an electronic door locking system. Would the following mechanism be secure at all to prevent tampering plain text information on card? hash private system key together ...
0
votes
1answer
253 views

Are all fields of the PE certificate directory hashed during authenticode signing?

In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
0
votes
2answers
9k views

Most efficient way to crack a NTLM hash

I've been given a non-salted NTLM hash and a week worth of time to find the password it hides. I have also been told the password length is 11 chars, and that it is a Windows 10 user password. I'm ...
2
votes
1answer
134 views

BIOS password hash

Is it possible to find the BIOS password hash in a BIOS dump and decrypt it? For instance, a person could use flashrom Live CD to dump the BIOS with flashrom -r but how would you find the BIOS ...
2
votes
1answer
82 views

Has scrypt gone through enough testing to be considered secure?

Five years ago, an extremely similar question was asked: has scrypt withstood the test of time. Since this was asked five years ago and some of the responses were mixed, such as: "Scrypt has mostly ...
0
votes
0answers
34 views

Is this implementation of a bcrypt EtM flawed?

I know that you should never roll your own crypto, but I'm just implementing/combining(?) two highly trusted algorithms into Javascript First, I am using a bcrypt implementation that I did not code. ...
32
votes
3answers
5k views

Which is the best password hashing algorithm in .NET Core?

What are the considerations when picking the best password hashing algorithm in .NET Core? I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
3
votes
3answers
158 views

Is a Whirlpool hash with random salt secure enough?

I copied the title from another question, but it wasn't answered there and my case is a bit different. I have inherited an old website to maintain. I noticed that the password hashing is not up to ...
11
votes
3answers
547 views

Why do salts for hashing passwords need to be globally unique, not just system/site-unique?

I was reading an answer by Terry Chia to another question about the requirements for a salt, in which he/she (among others) specified that salts need to be globally unique, but don't go into any ...
2
votes
3answers
359 views

Secure preshared key 2 way authentication

I have the following setup: A server and a client will be connected over tcp. The server and client both have access to the preshared secret key. When the client connects to the server, the client and ...
2
votes
2answers
102 views

Am I using RfcDeriveBytes correctly, when the salt I'm providing it contains the password?

I'm using Rfc2898DeriveBytes in my application to encrypt a password with a randomly generated salt, and with a set iterator count for slowness. Before, I just grabbed the generated salt and put it ...
49
votes
1answer
18k views

In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?

There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
5
votes
3answers
2k views

Why are non-collision-resistant hash functions considered insecure for signing self-generated information

Let we have a hash function that is second preimage resistant but not collision-resistant. Then an adversary can create a pair of different messages M and M', M is benign and M' is malicious, for ...
0
votes
1answer
311 views

Both Ophcrack and ONTP&RE incorrectly show Windows 10 passwords as blank

I'm trying to crack a Windows 10 laptop that I myself set a password on a day or so ago. So far I've tried booting into Ophcrack 3.6 and ONTP&RE (Offline NT Password & Registry Editor) from ...
78
votes
5answers
76k views

How does hashing work?

I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it ...