Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
1answer
48 views

Hashing sessions and retrieving them using cookie(s) with session "id" and "token"

I'm implementing custom authentication & session management system in Node.js & PostgreSQL. My goal is to implement sessions that expire after 2 weeks (if not refreshed/renewed). OWASP and ...
5
votes
3answers
20k views

Is it possible to crack any SHA1 hashed password

I'm trying to understand how easy it is to crack a SHA1 hashed password. I have a training database giving hundreds of password hashed. I have tried to use some online tools to crack them and I have ...
7
votes
1answer
4k views

Which part of this encoded Argon2 hash is the salt?

I was reading the post Is it safe/wise to store a salt in the same field as the hashed password?: $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$fPn4sPgkFAuBJo3M3UzcGss3dJysxLJdPdvojRF20ZE= ...
1
vote
0answers
46 views

Choosing the right salt to pseudo-anonymize data and be GDPR compliant

In my company, numeric user IDs are considered PIIs and therefore need to be pseudo-anonymized to be GDPR compliant. To do so, we populate a lookup table where to each ID is assigned a monotonically ...
0
votes
0answers
35 views

How to use scrypt or Argon for Openldap version < 2.4.5 [migrated]

I know that support for Argon2 was released with OpenLdap 2.4.5 according to this link https://bugs.openldap.org/show_bug.cgi?id=8575, but what if I want to use it with a previous version like 2.4.4 ...
0
votes
1answer
224 views

John the ripper not able to crack the password

I generated two hashes from this site: Plaintext 1 (p1): world Salt 1 (s1): hello Hash 1 (h1): 936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af Plaintext 2 (p2): world2 Salt 2 (s2)...
1
vote
0answers
2k views

John the Ripper doesn't crack passwords when I use wordlists [duplicate]

Title says it all, I can't tell if John is just crashing or "gives up" on cracking the hash. First I start off by creating an md5 hash out of a word I KNOW is on the rockyou.txt wordlist: echo -n '...
0
votes
1answer
75 views

Does hashing really make this home rolled sso process more secure?

I had configured subdomains on a site to share forms authentication, however decisions were made to change one of websites over to a different domain. So now site A needs to send a user to the site B. ...
2
votes
3answers
159 views

Is it sensible to accept a password + any other random characters for successful authentication?

Supposing a user of my system has set their password to Password123 At the login screen, what would be the security implications of me accepting: Password123 or Password1234 or Password123ABC Based on ...
0
votes
1answer
51 views

Is there a use for an MDC even when all messages are signed?

I guess I have halfway grasped the concepts of PGP, and I've halfway understood the concept of the Efail attack. However, I still don't understand whether such attacks would be possible (and an MDC ...
0
votes
1answer
90 views

Store a password as an identifier (as safely as possible)... since there is no other choice

I have to deal with a place that has some terrible security practices. For example, this place gives people passwords (eg. domain logon on Windows, but paired with their name as the username) that is ...
1
vote
3answers
161 views

To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?

I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
1
vote
1answer
497 views

Postfix + MySQL ENCRYPT() encryption method change

I already have my mail server (postfix, courier, mysql) and roundcube as my webmail client, Encrypt() is the current password encryption function, Is there a way to change the default password ...
7
votes
2answers
1k views

When can you not use strcmp?

I've read that one shouldn't use strncmp(userSuppliedPassword,origPassword,sizeOfArray) (or String.equals in Java) since one can use a timing attack to guess the password. Rather, one should use a ...
0
votes
1answer
89 views

Generating tokens via PRNG and Hashing

We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it Step 1: Generate a random number using a good a CSPRNG ...
-1
votes
3answers
108 views

Binary versus ASCII representation of a hash - which is more secure

I am using SHA256 to create a hash. Output is captured as a text string (thus "A245B6FF") and that is what has been used to create the digital signature. Since the hash could have been ...
0
votes
1answer
96 views

Secure ajax login form

When the client is logging in, I send an xhr request to the server. However the request looks like this: localhost:80/api/login-ajax/&username=johndoe&password=123456 This is insecure for ...
3
votes
3answers
481 views

Secure preshared key 2 way authentication

I have the following setup: A server and a client will be connected over tcp. The server and client both have access to the preshared secret key. When the client connects to the server, the client and ...
1
vote
3answers
143 views

Does hashing syslog (or similar) make for good passwords?

I thought of an approach to password generation that I haven't heard of anyone else using. It almost seems too good to be true so I wonder what the downsides are. I'm well aware that you shouldn't &...
21
votes
2answers
7k views

How secure is BCRYPT(SHA1(Password)) [duplicate]

This question is a fork from a previous question here: Is it safe/wise to store a salt in the same field as the hashed password? Assume you run a web portal, and store passwords in SHA1 hashes. How ...
0
votes
1answer
185 views

How does john the ripper crack hashes using wordlists?

How does John The Ripper work when trying to crack passphrase of a private ssh key? As in what steps are involved when it tries to do so? What's the role of ssh2john in the whole process?
2
votes
1answer
2k views

Loki How to crack the password hash OSPF?

I have created for myself a lab of routers in GNS3 . Routing protocol between routers is OSPF. Now,by Loki penetration testing, I found that routers are the feature authentication. Using wireshark, I ...
7
votes
3answers
185 views

Does there exist any hashing algorithms suitable for comparing data that is similar but not exact matches?

Does there exist any hashing algorithms suitable for comparing data that is similar but not exact matches? For example one where similar input data generates a similar hash, with the difference in the ...
1
vote
1answer
122 views

Does using a random number of iterations for PKBDF2-SHA256 help if I only have to protect one key used to encrypt a password protecteded file? [duplicate]

I read about Recommended # of iterations when using PBKDF2-SHA256? I have also read in Why not just use a small but unusual number of hashing rounds? that when there are multiple password to protect, ...
0
votes
1answer
52 views

Is it possible to find out the encryption algorithm used from hexadecimal hash? [duplicate]

Can we find out the encryption method used if we know what is encrypted inside? Let's assume there are around 7-digits 22 or 26 codes (passwords ie just decimals) encrypted to 832 characters ...
0
votes
0answers
72 views

Get encrypted PDF password

For a CTF challenge, I got a locked PDF file with a data folder that contains images, a plaintext file and a wav audio file. I used pdf2john.pl to get the password hash and I performed a brute force ...
216
votes
7answers
83k views

Recommended # of iterations when using PBKDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
7
votes
3answers
4k views

Why not just use a small but unusual number of hashing rounds?

When it comes to hashing passwords, it is nowadays practice to do 100'000 or 200'000 iterations of SHA256/SHA512, or at least something in that ballpark. But my question is, why is it not safe enough ...
2
votes
1answer
97 views

How to convert passphrase to AES256 key?

My plan is to convert a passphrase in UTF-8 ASCII-US to Unit8Array(32) then use it in: 256bitsKey = Unit8Array(32) from passphase iv = window.crypto.getRandomValues(new Uint8Array(32)); CryptoJS.enc....
9
votes
6answers
3k views

Can iterated hashes be used to create cryptographically secure random data from strong random seed?

I was wondering if generation of sequential hashes from random seed can be considered "random enough" to be used in cryptographic operations? By sequential hashes I mean the following: First ...
5
votes
1answer
17k views

John the ripper passwd file format with salt not working

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is: $hash = md5($salt . $pass) No other ...
4
votes
2answers
29k views

NTLM/LM Hashes on Domain Controller

I've noticed that when extracting password hashes from a domain controller (using Elcomsoft proactive password auditor) sometimes I'll get LM and NTLM hashes and other times I'll only get NTLM hashes. ...
0
votes
0answers
46 views

Using predictable incrementing nonces

I need validation / feedback please with the implementation of a web based client-server application that I am building. I need to make sure that a client's cookies can't be hijacked and therefore I ...
0
votes
0answers
11 views

Identify hash pattern inside a string [duplicate]

I believe that this question was answered already, though I couldn't find it. I have several strings that include hash. Each string has hash and some random (or not) add-on. How can I identify the ...
4
votes
2answers
1k views

How to apply FIPS to Microsoft Access database with custom VBA

As the software engineer on a project, I have been asked to make a Microsoft Access application, with custom interfaces running custom VBA. That part is going just fine. Recently though I was asked to ...
21
votes
2answers
14k views

Does Windows really still use unsalted MD4 for password storage?

I find it quite difficult to believe that the passwords in Active Directory for Windows 2008 R2 are still stored using the unsalted MD4 (aka "NT Hash") algorithm. Can it really be true? I've been ...
0
votes
1answer
338 views

John the ripper - ecryptfs - sample not cracked: 0 password hashes cracked

I tried to use john the ripper on the sample : ecryptfs_sample_metadata.tar (password is 'openwall') Which I downloaded from here: https://openwall.info/wiki/john/sample-non-hashes If i try sudo ...
1
vote
1answer
704 views

John the Ripper is unable to crack my SHA1 hashed password

John the Ripper is unable to crack my SHA1 hashed password: john --wordlist=rockyou.txt testing.txt Whenever I do this in Kali Linux, I get this response: Loaded 1 password hash (Raw-SHA1 [SHA1 256/...
4
votes
7answers
466 views

Is hashing a string a secure manner for generating passwords?

I have several servers that I'm using for an online business. I have passwords for MySQL, Wordpress, SSH, FTP, Domain Provider, Paypal, and many more. I wanted to have a different, very long password ...
7
votes
2answers
6k views

What is the difference between Key Derivation Function and (salted) Hash?

I see in this post that the main difference is that KDF outputs have "certain randomness properties", and I don't understand what does it mean. Suposing that that "certain randomness properties" are ...
0
votes
1answer
51 views

One-way cryptographic algorithm with distinct output and verifiable property

I'm working on a API which is serving content based on user requests. What I'd like to achieve is as follows: Having a constant key stored both on the server and the client machine (as a means of ...
1
vote
2answers
290 views

What is the point of storing hashed passwords? If that file is read, doesn't that mean the computer has already been compromised?

Why is it necessary to store operating system passwords hashed? From what I've learned, passwords are stored on the hard drive/SSD in /etc/shadow. However, if a malicious agent was able to get access ...
0
votes
1answer
347 views

PHP - Does password_hash/Argon2i effectively truncate passwords after certain length?

If I'm not wrong, by default PHP's password_hash with PASSWORD_ARGON2I outputs a 43-character alphanumeric hash among other things. While this means that simple passwords that are shorter than 43 ...
0
votes
1answer
149 views

OpenSSL: how to get matching subject_hash from a CMS SignerInfo?

So OpenSSL can calculate a hash value for X509 certificates that uniquely identifies this certificate: https://www.openssl.org/docs/man1.0.2/man1/x509.html (argument -hash or -subject_hash) now, if I ...
248
votes
12answers
127k views

Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?

Why can't a password hash be reverse engineered? I've looked into this ages ago and have read lots on it, but I can't find the explanation of why it can't be done. An example will make it easier to ...
0
votes
0answers
63 views

Guessing UUIDv1 hashes?

I'm digging into UUIDv1 generation and bruteforce, in order to take control of a password reset feature of a website which sends a link with a get parameter token=UUIDvX. I'm trying to identify which ...
3
votes
3answers
15k views

How Facebook hashes passwords

I found this presentation how Facebook stores customer passwords and how they do authentication. This slide shows how they hash passwords: Is it a good idea to do such operations with a raw password?...
1
vote
1answer
162 views

How safe is AES 256bitkey encoded in HEX, Base64?

I am using CryptoJS AES 256 encryption: CryptoJS.AES.encrypt(realData, generateKey(passphrase), {iv: iv}); The secret is generated through: function generateKey(passphrase) { const salt = CryptoJS....
901
votes
12answers
286k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
0
votes
1answer
60 views

Does john the ripper need to be given the hash format in order to crack it?

Doing some hash rooms on THM and whenever I run the hash files they give me ill just start like this. john --wordlist=rockyou.txt hashfile It will run and then output with a bunch of warnings telling ...

1
2 3 4 5
43