Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
1answer
35 views

Swift HMAC doesn't match NodeJS HMAC, but only sometimes!

I have discovered a HUGE issue in my code, and I have literally no idea what is causing this. SO, when I send requests to my server I hash a string thats in the request. This is sometimes user input....
0
votes
0answers
34 views

How to implement token based authentication for my API? [migrated]

I have a Django backend which will be served as my API endpoints. Users are identified by username and password and have some extra information and should be able to consume my same API, so I want to ...
1
vote
1answer
135 views

Is there a unique way to identify a hardware?

I'm considering an environment in which I will have to identify a computer. In this scenario all hardware parts (CPU, HDDs, RAM, etc) won't change, while I'd like to consider a changing OS. The goal ...
8
votes
2answers
3k views

How to generate short fixed length cryptographic hashes?

I am trying to implement a kind of email verification system with a node.js server with no state. The strategy User sends his email to the server Server generates a 4 digits code based on the email ...
0
votes
0answers
33 views

Is Argon2 secure to use? [duplicate]

Now that it's been 5 years since Argon2 has been released, is Argon2 secure for public use? (E.g. normal password hashing) Also, what are the secure parameters for Argon2?
0
votes
1answer
80 views

Can I crack a zip file using Hash Suite on Windows?

I'm trying to crack a password I set on a zip file using Hash Suite but it doesn't seem to work for me (not sure if I'm doing everything correctly). Basically, this is what I've done: Created a ...
-1
votes
0answers
35 views

Which hashing function should I use for a high-importance authentication? How long should the salt be? [duplicate]

Let's assume I have a high-importance server (gov't or high-level corporate authentication), and I only have a couple users (2-10) who have to actually log in/authenticate. They are fine waiting about ...
2
votes
1answer
75 views

Has scrypt gone through enough testing to be considered secure?

Five years ago, an extremely similar question was asked: has scrypt withstood the test of time. Since this was asked five years ago and some of the responses were mixed, such as: "Scrypt has mostly ...
0
votes
0answers
34 views

Is this implementation of a bcrypt EtM flawed?

I know that you should never roll your own crypto, but I'm just implementing/combining(?) two highly trusted algorithms into Javascript First, I am using a bcrypt implementation that I did not code. ...
32
votes
3answers
5k views

Which is the best password hashing algorithm in .NET Core?

What are the considerations when picking the best password hashing algorithm in .NET Core? I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
3
votes
3answers
147 views

Is a Whirlpool hash with random salt secure enough?

I copied the title from another question, but it wasn't answered there and my case is a bit different. I have inherited an old website to maintain. I noticed that the password hashing is not up to ...
2
votes
2answers
80 views

Am I using RfcDeriveBytes correctly, when the salt I'm providing it contains the password?

I'm using Rfc2898DeriveBytes in my application to encrypt a password with a randomly generated salt, and with a set iterator count for slowness. Before, I just grabbed the generated salt and put it ...
5
votes
3answers
1k views

Why are non-collision-resistant hash functions considered insecure for signing self-generated information

Let we have a hash function that is second preimage resistant but not collision-resistant. Then an adversary can create a pair of different messages M and M', M is benign and M' is malicious, for ...
0
votes
0answers
5 views

Statistical Analysis of Cryptographic Hashing Algorithms [migrated]

I was wondering how can I use NIST Statistical Test Suite to check for the randomness of output generated by a cryptographic hashing algorithm, let say SHA-256? To be specific, how will I generate ...
0
votes
1answer
65 views

How can I apply message digest to the application so that user can validate the accuracy and completeness of the software [closed]

I have developed the application and now it's time to distribute to my users. I was reviewing my application and reading security best practises and found below statement in one of the article. ...
2
votes
0answers
126 views

How does Veracrypt work?

I’m a layman in security and was trying to understand how hashes and encryption algorithms are used in Veracrypt/Truecrypt. Reading the documentation, this is what I understood (please, feel free to ...
1
vote
3answers
138 views

Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?

Under GDPR, IP addresses are personal data. I have no need to trace back IP to specific users, but I would like to limit downloads to one per IP.* I do not want to store plain IPs. My first solution ...
0
votes
1answer
115 views

is possible someone break the algorythm of my dice game with hashes

I just want to know how much secure are these games. I coded my own game and now want to know how much secure is. If for example the hash is visible(before you bet) would be possible decipher this ...
0
votes
0answers
48 views

Is client-side password hashing still useful when using TLS? Is TLS crackable? What about PFS? [duplicate]

Is client-side password hashing still necessary / useful when using TLS? What about TLS protocols with PFS (perfect forward secrecy) like Diffie-Hellman? Let’s say that I’m running a web application ...
23
votes
7answers
6k views

How can I re-use my password and still protect the password if it is exposed from one source?

I know that all servers should at least store my credentials as hash(password + salt) + salt, with a secure and well known hash function and a salt unique for me, generated from a secure and well ...
2
votes
1answer
130 views

BIOS password hash

Is it possible to find the BIOS password hash in a BIOS dump and decrypt it? For instance, a person could use flashrom Live CD to dump the BIOS with flashrom -r but how would you find the BIOS ...
1
vote
1answer
82 views

Cryptographic hash function vs. non-cryptographic hash function examples and compare

I would love to understand at the most basic level what their differences are. When is each one used? Any advantages and disadvantages?
2
votes
1answer
103 views

Is sha256 a good function to derive 256 bit keys from a secret of sufficient length and entropy?

Assuming I have a secret key of sufficient length and entropy (I get to decide the length and have a good random source). I would like to generate 256 length keys by hashing the root key with the ...
2
votes
1answer
122 views

Were software “CD key” schemes backdoored or simply misdesigned?

Back in the day, retail software was shipped on physical CDs that often had a printed "CD key" label affixed. The (usually alphanumeric) key on the label was unique to that particular copy of the ...
1
vote
1answer
90 views

Would Hashing a Decryption Key Significantly Lower Security? [duplicate]

I'm using the Haskell Codec.Crypto.SimpleAES package to create a crude password manager. The password manager seems secure but it's unable to warn the user when the decryption key is invalid. If a ...
2
votes
1answer
95 views

Is there a password based challenge response authentication scheme with public key cryptography?

I was thinking about an authentication where the user only has to know a password but no salt, everything else the client retrieves from the server yet a user's password can't be retrieved from the ...
0
votes
3answers
106 views

Is it safe to protect the write permission only with a publicly accessible hashed password?

A user stores a raw information (a comment on a website, a like on a post etc.) in a database. He pairs it with a hashed password and keep the original password safely for him/herself. This password ...
0
votes
1answer
56 views

How to identify the right hash from a list of salts and pre-given password during authentication?

I apologize for being naive, but I only recently started learning about cryptography and how to go about the security online. From what I've gathered, the safest-without-sacrificing-efficiency way ...
0
votes
1answer
70 views

Does it increase security to hash a SHA1 hash with a common salt with SHA256 with individual salt [duplicate]

I tried to find a similar question but I did not find a question describing my exact scenario and I am still puzzled if the following actually makes an application more secure. I have legacy ...
2
votes
0answers
69 views

Add additional rounds on existing SHA-512 salted hashes without knowing clear text password?

Assuming you have a salted SHA-512 password hash with 5000 rounds. For example: {CRYPT}$6$rounds=5000$6835c5dcf0bb7310$hVod/jy7uONMSa.FVpLHb/2OrWpAj3lB/....
3
votes
3answers
261 views

Password hashing algorithms suitable for IoT devices?

What password hashing algorithms and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home ...
0
votes
3answers
86 views

Is it possible to build a partial search mechanism on hashed values? [closed]

I am hashing some sensitive values to support search mechanism as decrypting the values at run-time would be time consuming. I'm using SHA-512 with salt. For now, things look good. I have the hashes ...
37
votes
8answers
15k views

Isn't “Dave's protocol” good if only the database, and not the code, is leaked?

I've read "Is my developer's home-brew password security right or wrong, and why?", but there's still a question in my mind: Even if someone uses a bad, home-brewed security algorithm just like Dave, ...
-2
votes
1answer
160 views

Which is the weakest hashing algorithm? [closed]

After studying about hashing algorithms and encryption formulas, I was interested to find which hashing algorithm was the weakest of all. I'm sure it is some weak and old algorithm, but it would be ...
0
votes
3answers
173 views

Can a hashing function be implemented insecurely?

After working on a an imaginary security related project, it was decided that the project is going to use the imaginary hashing function X. There are various implementations of the hashing function ...
0
votes
1answer
63 views

What does a hash output (a fingerprint) can be truncated mean?

From Public key fingerprint (Wikipedia) : Creating public key fingerprints ... 3. If desired, the hash function output can be truncated to provide a shorter, more convenient fingerprint. ...
0
votes
3answers
71 views

How to make the first request which used to create account safe? [duplicate]

To authorize user, our application defined below steps: Send user email and password (plain text) through HTTPS. When server received it, generate a salt to hash password and store it. When user ...
2
votes
1answer
130 views

Is there any benefit to using a salt when the cleartext is random data?

I understand that using a salt makes it harder to find cleartext using rainbow tables - but in that scenario the clear text is structured / low entropy. If my clear text is generated randomly, then is ...
2
votes
2answers
110 views

Hash value changes after first opening a file

Is it possible or normal that the hash value of a file changes just after the first opening/execution of it? I used sha256sum function within Ubuntu terminal to check the hash values before and after ...
2
votes
1answer
156 views

Cryptographic requirements for GDPR

I'm looking into how to store emails and data regarding GDPR. The reasoning is that it would be beneficial to store users emails linked to certain data (shop data about purchases and questionnaires). ...
1
vote
0answers
58 views

When knowing an individual's plaintext password history, how much information is expected to be gained with a new password? Do we know this?

The premise: Knowing a persons password history should provide information to help when guessing a new password of theirs. At an extreme end, with a password history of wildcats, wildcats1, then ...
0
votes
1answer
421 views

Estimating Password Cracking Speed Based on GPU?

I was wondering if there was a calculator or formula I could use to find a rough estimation of the time it takes to crack hashes based on GPU. I am trying to assess how much performance I would lose/...
1
vote
2answers
90 views

Should Google User ID's be hashed when stored in the database

I'm currently developing an auth backend that allows for both Google and Email/Password as authentication methods. I'm basically treating the Google ID and Password as credentials here. I'm already ...
63
votes
1answer
13k views

I found a password with hashcat, but it doesn't work

My assignment required me to find the password for a PowerPoint file (97 - 2003, v. 8.0 - v. 11.0). I used office2john.py to retrieve the hash, and I removed the file name. The hash is: $...
0
votes
0answers
74 views

Where are NTLM and LM hashes stored in a password protected microsoft presentation file

I have a password protected presentation file (MS office 2003). My assignment required me to either remove the password or find it. In my research i found out that presentation use ntlm and/or nt ...
1
vote
2answers
116 views

Can a document be digitally signed multiple times, successively by different users?

The question is, if a document that is collaboratively edited, one user per time, could be digitally signed by every editor before it is passed to the next editor. And if yes, could the final receiver ...
27
votes
4answers
6k views

Does putting salt first make it easier for attacker to bruteforce the hash?

Many recommendations for storing passwords recommend hash(salt + password) rather than hash(password + salt). Doesn't putting the salt first make it much faster for the attacker to bruteforce the ...
0
votes
0answers
92 views

Custom password security algorithm? [duplicate]

How secure would it be if you applied custom algorithms (that you obviously wouldn't reveal to the public) to a hashed password? Like splitting up a hashed string, shuffling it around, possibly even ...
0
votes
1answer
85 views

What kind of hash does the VeraCrypt tool use?

Whirlpool? SHA-512? Or something completely different?
26
votes
3answers
6k views

How bad would a partial hash leak be, realistically?

Even though the current recommendation for storing passwords is the usage of a slow key derivation function such as Argon2, scrypt, PBKDF2 or bcrypt1, many websites still use the traditional hash(...