Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
1answer
57 views

Password storage which avoids privileged insider attack

What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
3
votes
1answer
171 views

Is hashing without a salt secure for random passwords? [duplicate]

I'm designing an API with token authentication. I don't want to store tokens as plain text in the database, for the same reason user passwords are not stored as plain text: if the database gets ...
2
votes
0answers
65 views

Extracted LM Hashes doesnt match actual password

I'm new to LM Hashing and Windows authentication, and I'm having problems with LM hashes. I've created 2 accounts with the password "123", and both of them have different hashes, and none of the ...
-1
votes
1answer
81 views

Can one alter SHA-1 input data without changing the hash internal state? [duplicate]

Let's say I have an input message of "enoughly long" length (I'll got for a 128 bytes long message, but it might be 256 or whatever). I know the hash sha1(message || secret) where || is byte ...
1
vote
2answers
291 views

PHP password_hash (bcrypt) vs sha-3 [duplicate]

password_hash() is the recommended function in PHP to generate password hashes. The standard usage is password_hash($password, PASSWORD_DEFAULT); and default hash with PASSWORD_DEFAULT is bcrypt. The ...
1
vote
2answers
114 views

Comparing uniquely salted hashes

I have a system which needs to compare hashed identifier values. I want to salt my hashes, to prevent them being cracked with a rainbow table. However, the system needs to be able to compare the ...
0
votes
0answers
40 views

Is there a protocol fuzzer or fuzzing framework that uses cryptography?

When reading about fuzzing, the way to go seems to ignore checksums and cryptographic integrity protection or at least circumvent verification procedures via a 'fuzz-friendly mode'. For black-box ...
-1
votes
1answer
56 views

Is this method of storing a data-field secure?

I'm trying to convert a data field to something tokenized(that's to something not-sensitive). The current scenario is, I've got a data field (assume user-id) which is unique for each user, I don't ...
0
votes
1answer
630 views

Hashcat - separator unmatched running pmkid 16800 crack

I'm working on cracking a pmkid file. I have collected pcap file using bettercap. Then convert using this: hcxpcaptool -z bettercap-wifi-handshakes.pcap.pmkid bettercap-wifi-handshakes.pcap They ...
0
votes
1answer
88 views

When encrypting password hashes, how to handle nonces?

I know that encrypting password hashes is a contentious issue. However, I have seen it recommended in some quarters. I know for instance that DropBox did this at one time with AES256. In these cases, ...
3
votes
1answer
92 views

Is there any benefit using a two-step salted hash? [closed]

Commonly when implementing authentication mechanisms that accept passwords is to add salt when hashing the password. Reading the article here: https://engineering.gosquared.com/evolution-of-password-...
1
vote
3answers
200 views

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
1
vote
1answer
85 views

Schemes for ID obfuscation like Facebook app scoped IDs

After certain privacy concerns Facebook rolled out a bunch of changes to their APIs, one being "scoping" user identifiers per app. In effect, this means that Alice's canonical facebook user ID is ...
0
votes
0answers
98 views

Is gnupg2 --refresh-keys susceptible to any attacks based on fingerprint collisions?

Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys Mallory ensures that Bob uses her keyserver, which offers her own key, which is sharing the 32-bit "short" Key ...
2
votes
1answer
70 views

What hashing algorithm does VirtualBox use for passwords in its config files?

To authenticate with RDP, VirtualBox allows to set a password using this command: VBoxManage setproperty vrdeauthlibrary "VBoxAuthSimple" VBoxManage modifyvm "VM name" --vrdeauthtype external ...
2
votes
2answers
640 views

Appending a secret (pepper) to Argon2 password hashes

I've read quite a bit of the StackExchange and HackerNews debates on the user of "peppers" in password hash security. There are a number of different implementations of the idea of a pepper, ranging ...
1
vote
3answers
157 views

Hash pepper in web application possible?

I have read a few articles and several question on here about hashing correctly. While hashing, adding salt and especially pepper is primarily a server side use case, I am interested in the ...
0
votes
0answers
275 views

bcrypt.checkpw() returning true for different salt+hash

new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
0
votes
0answers
43 views

Web app: using two hashing schemes for CPU-friendly password validation & secure storage [duplicate]

Consider a web application that: uses HTTP Basic Auth over HTTPS, and therefore needs to validate a password (an API Key) on every request and needs to handle a substantial load has very few distinct ...
13
votes
3answers
4k views

Hashing password to increase entropy

Is it secure to hash a password before using it in an application to increase password entropy? Does this practice increase entropy when a PBKDF is used in the application itself or does the PBKDF ...
0
votes
1answer
103 views

Can't detect hash type even if I have the password?

I can't found the hash type used in a database hosted in a VM. My hash is c39e02416d974229752c28d7fcefe6e1, and my password is "azerty123456". I noticed that the user table has a column called ...
0
votes
2answers
143 views

Can an attacker modify data so that the hashing technique cannot detect the change?

I'm just curious as to if this is possible or not?
3
votes
1answer
160 views

Is there a security difference between GPG signing a file directly or its SHA512SUM file?

I am about to decide what SHA-512 hash sum and / or GPG verification scheme I will choose. Let me present you with two options: Signing the 25 GB ~ 23 GiB (one file fit to a Blu-Ray) directly with: ...
0
votes
2answers
369 views

How long does it take to compute hashes using the MD5 hash algorithm? [closed]

1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds? 2) Will salted and unsalted versions of md5 hash algorithms take approximately the same ...
-1
votes
1answer
704 views

hashcat - cracking a salted sha256

Given a SHA512 hash, a salt, and username I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline without ...
14
votes
2answers
2k views

What are SHA-rounds?

I understand more sha-rounds make it difficult to bruteforce the hashed password in /etc/shadow. Higher rounds also use more CPU processing when executing sudo commands and logging into the Unix ...
0
votes
0answers
57 views

Does the password goes weaker as they get longer since hash has a fixed length? [duplicate]

For example, sha256 has a fixed hash length of 64 characters. So I'm wondering will a password goes weaker as they get longer and longer? Since no matter how long your password goes, the sum will be ...
0
votes
1answer
99 views

MD5 Checksum and DLL injection

I would like to know if it is possible that a file checksum or MD5 Checksum is an option for identifying malicious embedded code. As an example, I have a development environment and I want to prevent ...
0
votes
1answer
270 views

Is this method of hashing passwords good? Node.js [duplicate]

I am currently developing a login for my website, (using node.js and MySQL) and would like some feedback on the password hashing code. const crypto = require('crypto'); function RandomSaltString(...
-1
votes
1answer
96 views

Best tool for cracking SHA-1s with unique pre and post salts? [closed]

I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
0
votes
0answers
25 views

Does limiting the length of a password help prevent DoS attacks? [duplicate]

I was told that you can DoS a server with unlimited password length because of the time that it would take to hash it. But isn't the password hashed on the client's side before leaving the user's ...
1
vote
2answers
126 views

Is storing the bcrypt salt in isolated database a good idea?

I read many answers on the stackexchange about Bcrypt, Salt and Where exactly to place the salt. For hashes such as BCrypt it is trivial to extract salt from the hash. So, It doesn't matter really ...
-4
votes
1answer
120 views

If I hash a password 40 times, will it be breach proof? [duplicate]

Let's say I have a password like: password123 If I was to hash it 30 times, will it be (nearly) breach proof? I have a loop which goes through all the hashing algorithms and hashes them continuously. ...
2
votes
2answers
470 views

HMAC and key size

I generated a keyed hash using HMAC-MD5 and HMAC-SHA256 for an arbitrary file with various keys of different lengths. Do we have to use a key with a fixed size in HMAC? If so, what is the key size? ...
0
votes
0answers
34 views

Does a small max password length indicate there might be a security issue? [duplicate]

Some websites state specific requirements for a password when you create an account. Some are understandable, but in particular the maximum password length doesn't make sense to me. Some websites ...
4
votes
6answers
855 views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
9
votes
2answers
1k views

Is there a loss of entropy by hashing an N-bit random key to produce an N-bit hash?

I read the following piece of code: dd if=/dev/urandom bs=16 count=1 2>/dev/null | md5sum Apparently, this code was used as a trick to produce a hex string key from a 128-bit binary pseudo-random ...
0
votes
0answers
36 views

Where do salts come from? [duplicate]

A salt can be a random value and length. The hash and the salt are stored in the database. Is there a separate salt generator function used? Is it just a random generator? Does it need to be a ...
6
votes
3answers
212 views

What are the 'P' values in some cipher string?

Most of the cipher strings I see are in the format: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ...
0
votes
1answer
36 views

Generate DEK from password using hashing on client-side

Important to know Will not be passing the DEK from client to the server The DEK will be used to encrypt all the data being placed within a github repository, it is possible that cipher-text will be ...
-1
votes
1answer
149 views

Does salted password hashes expose users with blank passwords?

Traditionally, a 'salted' hash of the password is stored along with the salt so there is no plaintext in the database and still be able to authenticate the password. The salting process consists of ...
-1
votes
2answers
96 views

Can the following hash technique be reversed? If so, would it be difficult?

I was wondering if the following hashing technique can easily be reversed? If someone got hold of the hashed value, can he/she reverse it? Partiuclarly I'm talking about the following code: ...
2
votes
2answers
114 views

Private contact discovery - calculating probability of false positive [closed]

I'm working on contact discovery for a service and want to do it in a way that maintains privacy as much as possible, without using Signal's Private Contact Discovery Service (https://signal.org/blog/...
0
votes
0answers
174 views

How to securely store private keys in the DB?

I am implementing a web application that deals with signing blockchain transactions similar to what all cryptocurrency stock exchange applications are doing. I am wondering how do they store private ...
0
votes
0answers
122 views

Get hash and iv from V file in SAM folder Windows 10

Using information from this link: http://www.insecurity.be/blog/2018/01/21/retrieving-ntlm-hashes-and-what-changed-technical-writeup/#New_Style_Hash_Retrieval I try to do the same thing on VM with ...
0
votes
1answer
266 views

AES Keys Storage for encrypting hashes of SAM file in Windows 10

Hashes of user account passwords in Windows 10 (like in older versions) are stored in SAM file. Using standard utility pwdump 7 for getting these hashes gives following result: ::LM hash : NTLM hash ...
1
vote
2answers
236 views

Encryption and Hash algorithms explanation

I am using Veracrypt and there are encryption and hash algorithms Can anyone explain simply what do each algorithm does? Encryption algorithms encrypt your data/file, Hash algorithm hashes your ...
1
vote
1answer
98 views

Is it safe to reuse a user's hashed password as his token in the email confirmation link?

The user password is hashed with bycrypt. According to this answer: bcrypt is not an encryption function, it's a password hashing function, relying on Blowfish's key scheduling, not its encryption. ...
0
votes
0answers
174 views

How Windows 8 and Windows 10 hash account password?

I need some accurate information about how Windows 8 and Windows 10 perform hashing user account passwords. I know that they are stored in SAM file and NTLMv2 algorithm is used. But while using ...
22
votes
2answers
6k views

Hashing email addresses for GDPR compliance

UPDATED We have a very unique scenario: We have several old databases of user accounts. We'd like a new system to be able to connect these old accounts to new accounts on the new system, if the user ...