Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
2
votes
1answer
25 views

Which part of this encoded Argon2 hash is the salt?

I was reading this post Is it safe/wise to store a salt in the same field as the hashed password? $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$fPn4sPgkFAuBJo3M3UzcGss3dJysxLJdPdvojRF20ZE= ...
1
vote
2answers
62 views

Hash and data modification

If I have the MD5 and SHA1 hash matches for an encrypted container. Is there no possibility it's been modified? Is it safe to assume the container has never been modified?
6
votes
2answers
223 views

What is the best way to show a (long) number for comparison?

How to represent visually a number (like a key or hash) on a screen for visual comparison with another representation of that number on another screen (or another window) in such way that it would be ...
1
vote
1answer
71 views

Finding original command result from MD5 hash

Basically I hashed the result of the "date" command with md5sum: $date | md5sum The output is indeed in the likes of: e4c94362cd4fd71ec6aca78c7411bdc3 - My question was: is it possible to recover ...
18
votes
4answers
9k views

How long should a hash be to be absolutely secure?

Is there some sort of rule to determine how large a hash should be to ensure the security (meaning exactly one message maps to a given hash) of a message? Something that can be applied to any message,...
-1
votes
1answer
63 views

Calculating Time for a Attack on Password Hashes [closed]

Suppose I have a database containing hashes. Hashes are obtained from password developed from randomly chosen set of 94 characters such that each password size is of 8 characters. So we have 94^8 ...
-2
votes
0answers
27 views

Password Length and Key Length [duplicate]

Passwords are not stored in plain text. So we encrypt the password. But for encryption we have to use a key. Is there a issue if the password length and key length not same? (i.e. if we are using ...
3
votes
0answers
97 views

How to do client + server side hashing?

I don't want the password to be sent in clear text over the internet, even when using HTTPS the server admin can read the password if they somehow cache or log post requests. Now, what I have come ...
0
votes
1answer
95 views

should giving salt to unauthenticated users be a problem

Let's say i have a scenario when the user salt is required in client side before login, the user obtains the salt by this url http://my-api.example/get-salt/userid that url should return a salt for ...
16
votes
10answers
10k views

Crack hashed passwords using a known password

I'm a dev trying to deploy a new dashboard I've written at work, the old one is a mess of hacked together libraries and only about half of the codebase is still even in use (dead code everywhere that ...
14
votes
0answers
458 views

Is there any merit to the RFC 3414 (SNMPv3 User Security Model) password-to-key method?

RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at ...
3
votes
1answer
85 views

Is there an alternative to using hashing to identify malware?

I'm reading a sans paper on IOCs (indicators of compromise) in malware forensics and I came across this interesting obstacle: polymorphic and metamorphic codes (Paxson, 2011) result in multiple ...
5
votes
3answers
4k views

Why we use GPG signatures for file verification instead of hash values?

for example here they put a gpg signature to verify what you download is what they really made. but why they just don't put a SHA256 hash value ? because its much more faster to check it and sometimes ...
0
votes
3answers
133 views

Providing password review results to auditors

The IT Security department is getting audited and the auditor had approached our IT Security team and requests to see results of the password review process, which compares existing database of ...
610
votes
5answers
252k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
12
votes
5answers
3k views

Generating and securing gift card codes

I'm working for a company that is generating gift card codes which can be used to pay for goods on online stores. I'm wondering what the most secure way of generating these gift card codes are. The ...
4
votes
1answer
112 views

PBKDF2 doesn't seem to have a standardised implementation?

I recently read about the bug in Django with regards to PBKDF2 causing Denial of Service with large passwords: https://www.djangoproject.com/weblog/2013/sep/15/security/ This is because PBKDF2 "...
0
votes
1answer
78 views

What are the steps of hashing and steps of verifying password using salt and key? [duplicate]

What are the steps of hashing password during registration and login to an application using salt and key? Are the following steps considered correct if applied to an application?: 1- During ...
2
votes
1answer
89 views

How to configure .NET's PBKDF2 implementation (Rfc2898DeriveBytes) in 2019?

I want to use .NET's Rfc2898DeriveBytes functionality in order to store my passwords in a database. In order to use it, I still need to make several decisions which will influence the level of ...
15
votes
3answers
11k views

what is the difference between a mac and a digital signiture

I understand that a MAC algorithm takes a message and a private key as input and hashes them to a value. I understand that senders and receivers often use MACs to authenticate a message and check the ...
31
votes
4answers
42k views

Whats the difference between MAC vs hash

What is the difference between the two algorithms? One difference that I know of, is that MAC is keyed and hash is not.
-3
votes
1answer
53 views

Digital Certificates, exhaustive set of their uses and references [closed]

I am a newbie of sorts as far as particulars of security is concerned.can somebody list all the possible uses of a digital certificate? it is used in SSL, signing and what else? Also is there a good ...
2
votes
1answer
160 views

How to store a user's password in a database in 2019? [duplicate]

This question, but focused on .NET's given PBKDF2 implementation, has been asked here now. Situation I am currently updating a password storage mechanism for a website. My plan for storing a ...
0
votes
1answer
43 views

Generate DEK from password using hashing on client-side

Important to know Will not be passing the DEK from client to the server The DEK will be used to encrypt all the data being placed within a github repository, it is possible that cipher-text will be ...
6
votes
7answers
8k views

Is it possible to detect password length from hash? Does doubling your password add more security?

Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
1
vote
0answers
63 views

How can I maintain and automate a list of download URLs with known hashes? [closed]

I'm familiar with the concept of downloading a file and manually checking it against a published checksum. See How to verify the checksum of a downloaded file (pgp, sha, etc.)? and Is there a command ...
1
vote
1answer
94 views

Password hashing with salt. Where do you leave the salt? [duplicate]

I want to hash a set of sensitive data using a hash+salt. I've done a little research and now I know that: The salt should be random. The salt should not be reused. Using hashing without salt makes ...
34
votes
3answers
5k views

Which is the best password hashing algorithm in .NET Core?

What are the considerations when picking the best password hashing algorithm in .NET Core? I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
49
votes
2answers
39k views

Why would I choose SHA-256 over SHA-512 for a SSL/TLS certificate?

I'm looking to renew an SSL (okay, TLS) wildcard certificate with a well-known service. I need to provide a CSR, which I have created using a 2048-bit key. I also need to choose a signature hash. The ...
1
vote
1answer
1k views

Hashcat - separator unmatched running pmkid 16800 crack

I'm working on cracking a pmkid file. I have collected pcap file using bettercap. Then convert using this: hcxpcaptool -z bettercap-wifi-handshakes.pcap.pmkid bettercap-wifi-handshakes.pcap They ...
6
votes
1answer
515 views

Securely displaying hidden integers with MD5

A system I'm studying uses the following mechanism: a 19-digit integer is hashed via the MD5 algorithm and the salt of the integer is shown in plain sight to the user before they take an irreversible ...
0
votes
1answer
111 views

Is it secure to use a hash of a login token as an anti-csrf token?

Alright here is my proposal: Use a hash of a login token as the anti-CSRF token. Why this is a good idea? Prevents having to store anything extra on the client, the server, and less network traffic ...
61
votes
4answers
11k views

Is Bcrypt a hashing algorithm or is my study material wrong?

I'm currently studying for my Comptia Security+ exam and on a practice test online I got this question: Or, represented as text: ▶ Which of the following are hashing algorithms? (Select all that ...
87
votes
7answers
93k views

Is MD5 considered insecure?

After all these articles circulating online about md5 exploits, I am considering switching to another hash algorithm. As far as I know it's always been the algorithm of choice among numerous DBAs. Is ...
22
votes
8answers
6k views

How can I re-use my password and still protect the password if it is exposed from one source?

I know that all servers should at least store my credentials as hash(password + salt) + salt, with a secure and well known hash function and a salt unique for me, generated from a secure and well ...
1
vote
5answers
189 views

Can I use a cryptographic hash function to prove my authorship of an anonymous article?

From what I understand, hash functions are one-way functions. Let's say that I want to publish an opinion article anonymously, but there is a possibility that I later want to prove that I was the one ...
1
vote
0answers
96 views

Can I use Keycloak as a key store like Hashicorp Vault for an example? [closed]

Can I use Keycloak as a key store like Hashicorp Vault for an example? Keycloak has realm keys, can I use this feature as a secure key store and use it to encrypt and hash data in my web application? ...
0
votes
1answer
62 views

How are these transaction fingerprints colored?

For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
3
votes
3answers
1k views

Is there a good 160 bit alternative for SHA-1?

SHA-1 has long been considered insecure, and now the attacks have been demonstrated in practice also. The proposed alternative for SSL certificates is the SHA-2 suite of hash functions, of which SHA-...
0
votes
1answer
74 views

How should we apply the salt to the password? [duplicate]

According to Wikipedia: A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
1
vote
1answer
82 views

JohnTheRipper Advanced Mask

I have problem to construct advanced mask to crack hash of 7zip file. The password have 16 chars where are all lower, upper, decimal and !@#$%-_=+: Main information is that any char can't duplicate ...
0
votes
2answers
129 views

Why does php password_hash() generate different hashes for the same input? [duplicate]

I've been using password_hash('password', PASSWORD_DEFAULT) for an internal system, and while I was testing the code, I saw that it generated different hashes for the same input. Why does this ...
18
votes
3answers
42k views

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Maybe I have been negligent towards the verification of software I download over the Internet, but I (or anybody I ever met) have never tried to verify the checksum of the contents I download. And ...
1
vote
1answer
132 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
0
votes
2answers
49 views

Would verifying the integrity of my website by comparing digest on the client side work?

So today I read about the sub-resource integrity attribute feature for browsers. And I though of using the same concept to verify the integrity of my HTML to protect against tempering by my web host ...
1
vote
1answer
61 views

Does digested passwords send over a non encrypted channel offers additional security over plain text passwords?

I am learning about WS-Security and trying to compare different options offered by UsernameToken as described in this document. AFAIK, a digested password is a hash of the plain text password along ...
3
votes
1answer
57 views

Difference between linux hash sum utilities and online string to hash utilities

When I go online and calculate a hash from a string on some generator website, no matter the algorithm or the website, it is always a different output than if I do echo "password" | sha256sum (or ...
0
votes
2answers
53 views

Oauth2 PKCE - What security does “S256” provide over “plain”?

The Oauth PKCE protocol flow is as follows, as defined in RFC 7636: +-------------------+ | Authz Server ...
1
vote
4answers
2k views

Can hashing a file alter the file?

Is a hash function a Random Oracle(RO) function or will there be a chance that the hash function will alter the file (as part of function or by accident) that it is hashing?
0
votes
1answer
129 views

I don't know how to identify the method behind the hash [closed]

I found online an web app that is vulnerable to blind sql injection, I manage to get in users table and I looked at my password, in the table was the hased version, this one->57b0fcbe39b9336d, now I ...