Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
-2
votes
0answers
64 views

Simple problem of computer security [closed]

this problem introduces a hash function similar in spirit to sha that operates on letters instead of binary data. it is called the toy tetragraph hash (tth).9 given a message consisting of a sequence ...
1
vote
1answer
169 views

John the Ripper is unable to crack my SHA1 hashed password

John the Ripper is unable to crack my SHA1 hashed password: john --wordlist=rockyou.txt testing.txt Whenever I do this in Kali Linux, I get this response: Loaded 1 password hash (Raw-SHA1 [SHA1 256/...
0
votes
1answer
49 views

One-way cryptographic algorithm with distinct output and verifiable property

I'm working on a API which is serving content based on user requests. What I'd like to achieve is as follows: Having a constant key stored both on the server and the client machine (as a means of ...
-1
votes
0answers
65 views

Why is storing a password hashed more secure than storing it encrypted? [duplicate]

Assuming the hashing includes properly implemented salting and uses a proper password stretching algorithm such as scrypt, and that the encryption algorithm is a secure symmetric algorithm with a ...
1
vote
2answers
252 views

What is the point of storing hashed passwords? If that file is read, doesn't that mean the computer has already been compromised?

Why is it necessary to store operating system passwords hashed? From what I've learned, passwords are stored on the hard drive/SSD in /etc/shadow. However, if a malicious agent was able to get access ...
0
votes
0answers
59 views

Guessing UUIDv1 hashes?

I'm digging into UUIDv1 generation and bruteforce, in order to take control of a password reset feature of a website which sends a link with a get parameter token=UUIDvX. I'm trying to identify which ...
1
vote
1answer
130 views

How safe is AES 256bitkey encoded in HEX, Base64?

I am using CryptoJS AES 256 encryption: CryptoJS.AES.encrypt(realData, generateKey(passphrase), {iv: iv}); The secret is generated through: function generateKey(passphrase) { const salt = CryptoJS....
0
votes
1answer
57 views

Does john the ripper need to be given the hash format in order to crack it?

Doing some hash rooms on THM and whenever I run the hash files they give me ill just start like this. john --wordlist=rockyou.txt hashfile It will run and then output with a bunch of warnings telling ...
2
votes
1answer
96 views

Security implications of using a non-hash in the password column

Imagine a webapp that uses a traditional email-password-login, with the users-table saving the password salted and hashed using bcrypt. Now a secondary login method should be implemented, like an API ...
0
votes
0answers
13 views

Significant differences in hash cracking speeds? [duplicate]

I'm doing an educational hash research. I generated MD5 hash using online tools and cracked it within a second using Hashcat and certain wordlist (yes, one second). Then I produced a WPA handshake ...
0
votes
1answer
100 views

If a file is digitally signed, is posting a hash very useful for security purposes?

In this question I asked about how to handle situations when SHA-256 hashes are not available for a file downloaded from the internet that contains executable code. Another community member ...
0
votes
1answer
54 views

Making already hashed wordlists of all possible combinations [duplicate]

Let us imagine a situation where a company stores its user passwords (let's ignore salts, etc for now) using some hash (say sha256) and the company gets breached. All of the username and password ...
1
vote
0answers
59 views

When file hash not available, how to best check authenticity of a file?

Normally, The Document Foundation (TDF) publishes the SHA-256 and SHA-1 hashes, along with the MD5 checksum, for all LibreOffice releases. For example, see this. However, for their current release (...
2
votes
0answers
50 views

Pros and Cons of hashing password on DB or on API server interacting with db [closed]

I'm trying to understand what is good/bad about hashing a password on a database (like postgres) as opposed to hashing it on an api server and then sending it hashed to the db. Can anyone speak on ...
0
votes
2answers
152 views

How likely is a SHA256 hash to be brute forced on this conditions?

If a string has a length of 16 characters, but it is also known that the first 2 characters are fixed, and that the rest of the string has random letters but letters only, no digits nor special chars, ...
10
votes
4answers
2k views

Password management of emailed cleartext passwords

If a website emails a password in cleartext when you use the "forgot password" function, is there any possibility that the password is hashed? It does generate a different password if you ...
0
votes
2answers
96 views

Could blockchain be useful for a protocol to verify content from a trusted publisher in the way I'm thinking of? [closed]

The problem with static software whitelisting is that in the real world, employees with versatile jobs need to run unexpected programs. Company sets up a whitelist to limit what programs can run - ...
26
votes
3answers
7k views

Known strings to have the same MD5 hash, not colliding in real life?

I was reading this article about MD5 hash collisions in which it clearly states that these two strings (differences marked with ^): ...
22
votes
4answers
8k views

Does password length / complexity make any difference if hashes are leaked?

Password length/complexity only mitigates a brute force attack, correct? In the event of a hash leak, since any algorithm is a fixed length, there could potentially be a pre-image* with a very short / ...
1
vote
0answers
121 views

Using John the Ripper for Blockchain.info second password

Is there a way to use JtR for Blockchain.info's (v2) secondary password? I already tried the blockchain2john.py file, and it does not ask for primary password (which I know already) so it is going to ...
-3
votes
2answers
127 views

Number of biometric samples required to form an exhaustive set of fingerprint hashes?

Number of biometric samples required to form an exhaustive set of fingerprint hashes? Slight variations in the sample produce different hash values of the sample data. The answer linked below ...
0
votes
2answers
139 views

Odds of two messages sharing the same hash prefix

If only the first h bits of a certain SHA256 hash H of a certain message M are known, and one had managed to successfully guess an input message M' whereby SHA256( M' ) yielded an H' whose first h ...
0
votes
2answers
68 views

Does using subkeys provide better protection in this instance?

I was thinking of implementing the following scheme for encryption of many independent files: From the password, which is given by the user, generate a master key using for example HMAC-SHA. From ...
0
votes
0answers
69 views

Web authentication, replay, nonce and KEK

I am trying to figure out how to build a secure, playback-proof, web authentication scheme and at the same time be able to use a KEK at the server. After a lot of reading it seems that a reasonable ...
0
votes
1answer
71 views

Securing data stored on a file

Suppose I have an application, which when opened asks you to open a file and then "unlock" that file using a password that's configurable by the user. The file should be encrypted with ...
0
votes
2answers
127 views

Is it possible to reverse a hashed password? [duplicate]

Is it possible to reverse a password hashed with bcrypt?
11
votes
5answers
6k views

Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?

I was reading this article which talks about a design to shorten URLs, and in the design section, it says that the given URL can be hashed using a hashing algorithm such as MD5, and then be encoded ...
2
votes
1answer
78 views

How can I use a unique salt for each user

I know there are various questions that seem similar, for instance, this one. However, it does not answer my question. I'm creating a signup/login system (with node.js to be particular), and I'm ...
17
votes
1answer
5k views

How can Freeradius detect if the password provided is right when only the salted hash is stored in the database without the salt

I am discovering both Freeradius and the password hashing mechanism. I built a database (in MySQL) to store the passwords of some users. I have a user with the password in clear text, another one ...
0
votes
0answers
37 views

Display a token's expiration date to a user

We use multiple kinds of token in our system for : Invitation to joint a group Account creation (validate if the user possesses the email address) Validate email address The tokens are sent in a ...
0
votes
0answers
54 views

FedRamp Moderate question about hashing MD5

If I use MD5 but not for cryptography purposes, and not for any authentication or authorization mechanism, Am I in violation of FedRamp Moderate? BR
0
votes
2answers
130 views

Avoiding password cracking by using custom hashing procedure?

In summary: the idea behind password cracking is just to replicate the password validation procedure of a web server locally with lots and lots of attempts and check whether the output of that ...
2
votes
1answer
260 views

How good/bad is this implementation to secure password?

I've just started new project and decide to try something new, so I'am not using anymore EnityFramework and Identity framework. I Decide to try MongoDB, so i wanted to design from scratch storing ...
1
vote
1answer
84 views

Randomness of hash of (password + suffix)

Suppose I have a password, say "thisIsThePassword". Then I have MD5 hashes of that password followed by an increasing numeric suffix: MD5("thisIsThePassword1") = ...
1
vote
1answer
63 views

Is combining salt from two places secure enough and what length

I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough - The password is hashed using PBKDF2-SHA256 (which ...
0
votes
0answers
26 views

Can I truncate a hash value and keep (the expected amount) of collision resistance? [duplicate]

I'm building a URL-shortening tool. For an arbitrary link, I need to produce a fixed-length slug which will index the full URL in a database. For prettiness reasons, I'd like to keep the slug ...
5
votes
2answers
407 views

Since GPUs have gigabytes of memory, does Argon2id need to use gigabytes of memory as well in order to effectively thwart GPU cracking?

The common advice of benchmarking a password hashing algorithm and choosing the slowest acceptable cost factor doesn't work for algorithms with more than one parameter: adding a lot of iterations at ...
0
votes
0answers
79 views

Why Serrcom's H300s authentication mechanism for the router's web panel hashes the password at client side instead of sending it as is?

Whilst I was reverse engineering what calls are performed for Sercomm H300s web panel I found out that the javascript offered for web panel performs an awkward way for username and password ...
0
votes
3answers
81 views

How many bytes for password reset token? Should one take steps to hash or conceal raw CSPRNG bytes?

I'm trying to follow the OWASP 'Forgot Password Cheat Sheet' recommendations for password reset functionality via email. This requires my server to generate a token. OWASP says that PHP's random_bytes(...
0
votes
1answer
92 views

Replace hashed password by public key generated from password

I don't like my server having access to plaintext passwords. Instead of SRP, OPAQUE or another PAKE that needs several rounds, I was thinking I could take the username, server url and password, run a ...
-5
votes
2answers
82 views

Is there a way to programatically generate new hash functions that are secure?

Is it possible to programmatically generate different hash functions? Of course, it is. We can simply tweak the numerical parameters of the hash function. But is there a known way to generate secure ...
0
votes
0answers
74 views

error john the ripper on id_rsa conversion

Why doesn't my conversion from id_rsa work? I have an empty file in the final conversion idrsa.hash and when I use command cat idrsa.hash to check the result is ERRNO2 no such file or directory : ...
0
votes
0answers
64 views

Is salt even secure once hacker has access to the database? [duplicate]

I have seen so many articles which they write that the salt is stored together with the hashed password in the database. However, there's one thing that is bugging me. Since the plain text salt is ...
1
vote
1answer
75 views

How NTLM SSO is preformed on smartcard Kerberos logon?

I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved. After an interactive logon with kerberos, you will have in the cached credentials both ...
3
votes
1answer
392 views

How does Linux know if a new password is a “wrapped” version of a old one?

How does Linux know if a new password is a "wrapped" version of an old password? (or, the process of creating a new password) know "certain" parts of one's password? Let's say I ...
24
votes
6answers
11k views

Is it safe to publish the hash of my passwords?

How unsafe would be to publish the hash of my passwords? I have written a Python script for helping me to remember my basic passwords (computer password, encrypted backup password, AppleID password, ...
5
votes
4answers
2k views

Having a list of hashes for the same password compromise the security of the password?

An attacker want's access to a specific account, he doesn't know the password. It's a high entropy password. +128bits The attacker has the hash for the password (Assuming OWASP suggested bcrypt with ...
1
vote
1answer
272 views

Are bcrypt hashes safe enough if exposed?

Considering: A VERY motivated attacker, A large entropy password, as in 256bits¹ hashed in bcrypt (with recommended cost factor of 12), and Attacker knowledge of everything he might need (except the ...
1
vote
2answers
174 views

Is it OK to hash sensitive data, given hashes provide no confidentiality?

Confidentiality is the property of a message whereby no one but the person who knows a secret (let's calle it K) can read the message. Hashes do not provide confidentiality (data is destroyed, you can'...
1
vote
0answers
160 views

Dynamic format used in John the Ripper jumbo way slower than MDXFind

I'm currently doing some research on a pretty huge list of hashes (approx. 2 millions) and thus I'd like to improve my cracking speed. The hash format is 12 rounds of SHA512(password + salt), which ...

1
2 3 4 5
43