Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
0answers
32 views

How does jarsigner -verify work?

Every jar file contains a MANIFEST.MF file containing a hash for every file. With jarsigner -verify you can verify a jar file, but what are the steps taken to verify a signed .class file in a jar? I ...
0
votes
1answer
32 views

John the Ripper / Hashcat rule, reject candidate if char at position X is the same as character at position Y

I'm using John to generate some word lists and I'm trying to figure out the most optimized way to do the next step. What I want to do is add ever possible 3 digit number to a set where the first digit ...
0
votes
0answers
82 views

rainbow table size and time to brute force [closed]

I have been trying to work the last two questions out (20.3 and 20.4) but I have been unsuccessful. 20.2. Given a password that is 15 characters long where each character can be one of the 52 ...
0
votes
0answers
17 views

Zyxel router custom hash algorithm [duplicate]

My router/access-point Zyxel nwa1123-ac pro stores passwords internally with a custom hashing algorithm. This is the resulting hash for the password "admin": $4$fmNgdX1E$...
-1
votes
0answers
46 views

Hash and autopsy [closed]

Can you access a particular sector of an image in autopsy software? Does calculating of an image allowed in autopsy software?
1
vote
1answer
77 views

Crack windows excel password

I have many password protected microsoft excel worksheet and I need to be able to edit it. I have forgotten the password, and I know that I can edit the file and take out the password check, but I ...
-4
votes
0answers
45 views

Hash identification [duplicate]

Can any security experts here identify this hash? f72825065497c03a82aa2ca09d84c7e:_*agDR12B2XC^F.%b#0Eo` Thanks in advance.
2
votes
2answers
65 views

How to store MFA secret

I have an online application that I'm adding MFA to, using the Google / Microsoft Authenticator apps for mobile phones. I've tried to adopt a security focussed approach to storing the MFA secret and ...
-1
votes
1answer
46 views

Why do no online services offer on-demand hash cracking? [closed]

Why do online tools for cracking a hash not offer the same functionality that hashcat does?
0
votes
1answer
45 views

File authentifications via PGP versus via unique file hashes

Many files that are available for download (eg in github) come along with "asc" signature files attached, or with a sha256 file hash. Can someone please explain difference of PGP signatures vs file ...
0
votes
1answer
32 views

Directly signing a file with gpg or instead its checksum file?

It is my understanding that when file is signed with gpg the signature will provide 2 guarantees, a proof of ownership of the signature and the integrity of the signed data. lets say I have a doc.txt ...
2
votes
0answers
69 views

Can I skip any password hashing for localhost authentication?

Setup I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system. everyone is on the same host they use the loopback interface (127.0.0.1) to ...
0
votes
2answers
46 views

Save private key in a database to share between multiple accounts

I don't know if my concept would be secure so I ask here. The main purpose is to log in with password x and also use that password to encrypt an RSA private key with AES to store that in the main ...
0
votes
2answers
47 views

Encrypting an object and storing the hash of its decryption key in the same database

To meet one of my application's needs, I must store an encrypted object in the database. Sometimes, I need to verify whether the user holds the right decryption key without the need to retrieve (...
0
votes
1answer
70 views

What vulnerabilities would this type of “password manager” have?

When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
28
votes
4answers
6k views

How secure is this hash-based personal password scheme? [duplicate]

I use a password scheme where I keep a small number of easy to remember personal passwords. Instead of using the passwords directly for each service, I run them through a hashing algorithm first, as a ...
0
votes
1answer
43 views

Is chain hashing algorithms the ultimate solution for hashing passwords?

Let's say I my password is a simple password, 123456 Then if the database was exposed, if the password was: -- stored in plain text -> cracked -- stored it hashed with no salt -> prone to rainbow ...
2
votes
2answers
100 views

Can you help me with some misconceptions about bcrypt and salting?

I researched password hashing and cracking and I have some misconceptions: First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute ...
0
votes
0answers
57 views

John the Ripper Obtain Password from Hash

John the Ripper 1. Ran ./pdf2john.pl /home/desktop/1.pdf > /home/desktop/1.txt (Hash inside 1.txt) 2. Ran ./john /home/desktop/1.txt Output: Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64]) No ...
0
votes
1answer
59 views

What advantage does HMAC provide in generating short hashes comparing to regular hash function?

This question is specific to the Apple/Google Contact Tracing framework. See https://www.blog.google/documents/56/Contact_Tracing_-_Cryptography_Specification.pdf for the cryptography spec. In this ...
2
votes
3answers
74 views

Password checking process for common websites

This will seem like a very basic question, but I wanted to make sure I don't miss something. When you enter your password in a login page and you press enter, what exactly happens right after until ...
5
votes
2answers
156 views

Can name and date of birth be hashed somehow to generate a secure identifier?

I'm working on a project which we intend to launch for developing countries, and, as a result, want to limit the amount of information needed for login and identification, while still maintaining ...
2
votes
1answer
54 views

Why does pwdump7 retrieve LM hashes even though they're disabled?

I'm currently undergoing a penetration testing certification, where I'm asked to : Set up a fully-patched Windows 10 Pro VM (done) Retrieve local password hashes from the SAM database using pwdump7 ...
0
votes
1answer
90 views

How to share information between devices, while keeping it anonymous

I'm developing an app for alert people if they encounter covid-19 positive person. I'm very much concern about user's privacy. So I need to make a user completely anonymous. What is want is as ...
0
votes
0answers
78 views

Safest alternative for hashing credit card numbers to use the hash as fingerprint?

Same question asked here in 2014 but since a lot has changed since then, I would like to get feedback from experts on the latest best practices. The problem We need to hash credit card numbers to ...
1
vote
1answer
93 views

Argon2id Configuration

I read an article about how to use Argon2id in C# here. Below is the code they wrote (slightly edited): using System; using System.Diagnostics; using System.Linq; using System.Security.Cryptography; ...
0
votes
1answer
72 views

Writing a Simple SHA256 Salted Hash Generator

I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications): using System; using System.Text; using System....
1
vote
1answer
223 views

Oversalting Potentially Harmful?

I find it hard to believe, and figure I just missed or forgot something obvious (years since I thought about this stuff), so maybe someone can point it out. But it seems like most of what I know about ...
0
votes
0answers
68 views

John the ripper - ecryptfs - sample not cracked: 0 password hashes cracked

I tried to use john the ripper on the sample : ecryptfs_sample_metadata.tar (password is 'openwall') Which I downloaded from here: https://openwall.info/wiki/john/sample-non-hashes If i try sudo ...
0
votes
1answer
61 views

Does TLS (Transport Layer Security) protect against deliberate tampering or accidental corruption?

If someone tampers with data being transmitted over HTTPS using TLS, would that result in a corrupted decrypted message or would it result in the error being detected such as through a cryptographic ...
0
votes
1answer
69 views

Using DD to get the hash of a non-system partition encrypted by VeraCrypt

I am trying to use DD for Windows to obtain the hash of a non-system partition that was encrypted via Veracrypt, but have run into a bit of a problem. The command I used to get the hash of the ...
1
vote
0answers
121 views

John the Ripper doesn't crack passwords when I use wordlists

Title says it all, I can't tell if John is just crashing or "gives up" on cracking the hash. First I start off by creating an md5 hash out of a word I KNOW is on the rockyou.txt wordlist: echo -n '...
0
votes
1answer
88 views

OAuth2 - Sending a hash of your client_secret when using the client credentials grant instead of the secret

I'm working on an API that I'd like to be accessible internally by other servers as well as devices that I consider both as confidential private clients. Devices are considered private clients because ...
0
votes
0answers
37 views

Are there any security implications of signing a hex digest over the binary digest?

Hash functions usually used for signing output a fixed amount of bytes. However, some tools output the data as an ASCII hex string, and other tools use the binary bytes. It is clear that from a ...
0
votes
0answers
66 views

Bruteforce different encodings

I have a hash $office$*2013*100000*256*16*664f9e0787392c2b1632d3947aaadee4*27dc7d029f76244a407acf9b5afa3740*ebbc055ae08124f6a6be81ef812da4fece16b2ad86eede3916d9cda15f71833f password: лl My wordlist:...
2
votes
1answer
113 views

What hashing strategy is recommended for desensitizing reporting data?

I need to desensitize data for reporting. There may be some PII but nothing like SSN, mostly Name or Phone. They won't be concatenated together anywhere. Also this is in the US with no European (or ...
0
votes
0answers
17 views

Does hashing client-side increase security when dealing with an untrustworthy server? [duplicate]

Does hashing once on clientside and once on server-side increase security when dealing with an untrustworthy server? For example when dealing with open source projects where users can self-host their ...
0
votes
0answers
48 views

Why is the BCrypt text “OrpheanBeholderScryDoubt”

I'm looking for a reference about the weird initial BCrypt text "OrpheanBeholderScryDoubt" Why was this string used? Would using 192 zeros or ones not have worked well in practice for some reason? ...
0
votes
1answer
82 views

Hash that outputs a 8 characters [duplicate]

I'm investigating a login system that exposes (probably) hashed passwords. Password: HTSr0MF8Ou4liOCUayXHDg== The password is stored in base64 format. When I decode it, I get random 8 chars ...
0
votes
2answers
70 views

Why hash on server instead of client? [duplicate]

Please hear me out. I used to scoff at people who asked this question because client-side hashing is "so obviously wrong." I have read similar questions on this site but haven't found a satisfactory ...
34
votes
5answers
6k views

Does it matter if a brute force search for a password returns a collision and not the password?

Assume the following very basic hashing algorithm. h(k) = k mod 17 Let's say we create a password 12345 for a website that uses this very basic hashing algorithm. That would yield the hash of 3. ...
0
votes
0answers
64 views

Why people buy stolen databases with emails and hashed passwords of users? [duplicate]

I see every now and then how hackers stole DB with emails and hashed passwords of millions of users from popular websites and sell it on the black market. I assume that passwords were hashed with ...
1
vote
0answers
87 views

Is multiplying hashes a valid way to ensure two sets of data are identical (but in arbitrary order)

Let's say "User A" has a set of data like below. Each entry has been hashed (sha256) to ensure integrity within a single entry. You can't modify data of a single entry without also modifying the ...
23
votes
13answers
8k views

How are hashing algorithms useful if the implementation is public?

I may be misunderstanding, but if I want to use a hashing algorithm such as argon2, what's stopping from someone seeing how it works and reversing what it does?
0
votes
0answers
53 views

Is the half_md4 dirent hashing algorithm a security problem in ext* filesystems?

half_md4 does not look a very strong hash for me, although googling for it does not reveal too much. I suspect, the directory entries could be organized by a half_md4 hashed hash table. If it is so, ...
0
votes
1answer
165 views

Can't solve format for Salted SHA1 hashes with Hashcat?

I am attempting to understand the format for this Salted SHA1 hash for an assignment. The line of text I was given was: nameExample@email.com,nameExample,nameExample@email.com,nameExample,,,...
1
vote
1answer
86 views

Should it be dangerous if I revealed part of a raw string of a hash?

This is a theoretical question about hashes, where I would want to know if the hash(“XY”) would be at risk if I revealed ‘X’. Where X can be a substring. Considering the most perfect hashing algorithm ...
0
votes
0answers
24 views

What type of encoding is this string? [duplicate]

I have an encoded string: VH+_+smN+IPimspbC+_+ygX73g== The original string is: 51756 So 51756 => VH+_+smN+IPimspbC+_+ygX73g== What is the encoding algorithm type? How can decode VH+_+smN+IPimspbC+...
0
votes
2answers
178 views

How can I give out a secret to the public that only I can decipher?

I wish to add an extra layer of security to my product (web app that people download and install on their server) that have a module that allows me, the developer, to access their sites instantly with ...
48
votes
8answers
10k views

Can you find out how big the changes are by comparing two hashes?

I realize that a hash function is a one way function, and that changes in the hash are suppose to tell us that the original data has changed (that the entire hash changes on even the slightest changes ...

1
2 3 4 5
40