Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0 votes
0 answers
31 views

How to verify the integrity of all binaries of packages installed manually via installers and dpkg on Debian/Linux?

How could one verify the integrity of all binaries of packages installed manually via installers and dpkg on Debian/Linux? So far the only thing I could think of is this: verify that which veracrypt ...
mYnDstrEAm's user avatar
0 votes
1 answer
41 views

Question about storing salt values and hashed passwords in the database [duplicate]

So I was reading through an article about how passwords are salted and hashed through a cryptographic function here, and found out that hashed passwords, along with the plaintext salt values are ...
mantot123's user avatar
0 votes
1 answer
48 views

Storing the hash of the plaintext and the encrypted plaintext next to each other [closed]

I generate a random string of 32 characters and then compute the SHA-512 hash then I encrypt the unhashed string. I then save the encrypted text and hash to the database. Is it okay to store the hash ...
user avatar
0 votes
0 answers
5 views

Random based on video input, why isn't there some predictability [migrated]

I just saw this article and many like them before where they use a video of some random movement and a hashing function to make a cryptographic random number generator but I'm always curious why this ...
Joost K's user avatar
  • 101
0 votes
2 answers
156 views

How bad would a Hash algorithm leak would be?

Context: When the Twitch whole code repository was leaked, it created multiple discussions on social medias. And one day I was on Reddit and said that the leak of the hashing algorithm and the salt ...
CARLOS EDUARDO NISHI's user avatar
1 vote
1 answer
208 views

Converting zip2john output to hashcat

I have video files stacked in zip and I forgot the password. I want to use hashcat, because john will take much longer, but the hash from hash zip2john isn't compatible and I don't know how to convert ...
GMike's user avatar
  • 11
1 vote
2 answers
177 views

Weak password hash + strong rate limiter = secure?

I have a microservice which sole purpose is to serve as a cache for other microservices. The point of the cache is to speed up processing, but the strong password hash algo counter that purpose. (...
Jasper Citi's user avatar
0 votes
1 answer
96 views

Algorithms when using client side hashing plus server side hashing

So if I got this right from my intense research, the following procedure would be preferrable: Use the PBKDF2 key derivation function to derive a secret key from the users password on the client side. ...
shaniag's user avatar
0 votes
1 answer
181 views

Passwords/password hashes in plaintext in service configs - why is this common practice?

A while ago I wanted to deploy a service using a OCI (docker/podman) container, and I noticed to me, what seemed like a possibly distributing trend. In the build file for a lot of the containers, the ...
The Floating Brain's user avatar
0 votes
0 answers
54 views

Trouble understanding hash_extension tool examples for hash length extension attack (C#)

I am trying to follow the example of how a hash length extension attack works using the article here: https://www.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks ...
arvedellis's user avatar
0 votes
4 answers
2k views

Can somebody explain simply why crypt of a password with a salt (the hash result) is equal to crypt of the password with the hash result itself?

Can somebody explain simply why crypt of a password with a salt (the hash result) is equal to crypt of the password with the hash result itself ? Surely there is a simple mathematical explanation. I ...
Winston L's user avatar
0 votes
0 answers
78 views

Revoking a digital signature at the cryptographic level

How do I indicate that a specific document or transaction associated with a particular signature should no longer be considered valid? I'm talking of recalling a signed document, not revoking the ...
microwth's user avatar
  • 2,473
1 vote
0 answers
84 views

Hash function the other way around [closed]

Is there anything that works like the opposite of a hash algorithm? Today we know many hash algorithms, which take an input, perform some math on it, and output a value which is different than the ...
Finn 's user avatar
  • 11
1 vote
1 answer
414 views

why the ja3 hash changed everytime refresh the webpage

I am reading some articles that told the ja3 hash will help to recognize the browser fingerprints, when I i access the https://tls.browserleaks.com/json with the google chrome browser. the ja3 hash ...
Dolphin's user avatar
  • 135
0 votes
2 answers
130 views

What does the IMAP banner alone show regarding security (STARTTLS, hashing, information disclosure)?

I encountered an open TCP/143 IMAP port which responded with this banner: * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5 AUTH=...
Bob Ortiz's user avatar
  • 6,665
0 votes
0 answers
151 views

Mixing argon2/HKDF to generate both password hash and encryption key?

I am trying to use a user password in my application to both generate a password hash (for authentication) and to derive a secret key to encrypt user data. Using argon2 is an expensive operation so i ...
codestation's user avatar
1 vote
1 answer
152 views

Is it possible to check for pwned/common passwords using salted hashes of the passwords?

If I administer a webpage that allows users to create accounts, and assuming I don't keep or even ever have access to plaintext passwords, is it possible for me to detect that one of my users is using ...
terdon's user avatar
  • 115
1 vote
1 answer
118 views

Is there any benefit to use different salt for different encryption algorithms for same user

There is two different passwords for a single user. I'm hashing both for future validation. I'm currently using a single unique salt for the user, but each is hashed with a different algorithms (...
user526498's user avatar
0 votes
0 answers
69 views

PGP keys as a hashing method

The context is described in another of my question, and is as follow : i've got to securely store identifiers, called TIP. We need (1) a method to derive always the same UID from a TIP, so that no ...
aluriak's user avatar
  • 133
0 votes
0 answers
124 views

What to do if i have no salt?

Here is my situation : we've got ID, named TIP, from remote and large databases. We want to store all the data, but laws prevents us to store the TIP directly, but rather anonymize them, for security ...
aluriak's user avatar
  • 133
0 votes
0 answers
27 views

Any idea on how this 36 character long string generated? [duplicate]

I have a personal id "U1KFhYtMqZhCYya6sy31PVLM8DlM5HLCkwy3", I have checked some hash functions but cannot make sure how this generated? Is this just random string generated with [a-zA-z0-9]?...
Slybot's user avatar
  • 101
0 votes
0 answers
76 views

Why are Laravel's refresh tokens so big?

Laravel Passport implements OAuth2 flows and does the usual thing of issuing access tokens in JWT format, and an opaque random string as the refresh token. These refresh tokens are enormous - around ...
Synchro's user avatar
  • 717
13 votes
4 answers
4k views

Is it common practice to take multiple hashes of the same object?

I was recently participating in a CTF with a challenge that required contestants to find two .pdf files with the same md5 hash, and that got me thinking about how that could be a potential ...
Blue Herring's user avatar
0 votes
0 answers
82 views

ow do I move password securely between api and web?

I would like to ask how I should go about securely transmitting the password between two applications. I have two projects that work with each other. The first one is a project called AuthApi, which ...
nikki's user avatar
  • 1
0 votes
2 answers
170 views

Should I be concerned that my bank told me that I have a strong password? [duplicate]

I recently ran an account security check through my bank's web site, and my bank "reassured" me that I have a strong password. Should I be concerned that they know that? I had assumed that ...
Very Tiny Brain's user avatar
0 votes
0 answers
28 views

Retrieve TOTP seed from tokens and timestamps [duplicate]

I recently switched to or added the option to use time-based one time passwords, TOTP, as the second factor for some services I use. It got me wondering if it's possible to retrieve the secret seed if ...
FalcoGer's user avatar
  • 402
0 votes
0 answers
80 views

What are password encryption schemes that result in variable length common in MySQL and PHP?

I have stumbled across passwords on a MySQL database behind a PHP webapp. Here are some examples. 753a524d56b48d825328ce27 789e0ad30d15 7ba0868c23e0a2 d327e265ca2abcd7c 48276b3d5618850 ...
knods's user avatar
  • 1
-2 votes
1 answer
269 views

Is it possible to bruteforce SHA256? [duplicate]

SHA256, 64 characters using only 0-9 or lowercase a-f Making 1.15792089E+77 total possible combinations. Is it possible to crack the input for its given hash?
San's user avatar
  • 1
1 vote
2 answers
1k views

Encrypted 7z file password not working

I'm in an interesting predicament. I have an encrypted 7z file that I made myself. The password for the file is a 60 character generated password that I saved to my password manager. I made sure to ...
CSstudent's user avatar
  • 113
2 votes
1 answer
252 views

John the Ripper - Zip Password help - Latter half digit command advice

I'm trying to use John to recover some old ZIP files with a password I remember half. One half being a word, the latter half being a mix of four to six digits. I remember the word, but not the digits ...
LEGEND-001's user avatar
0 votes
0 answers
26 views

Dump Windows 11 PIN hash [duplicate]

Can anyone tell me how to dump the Windows 11 PIN? I tried dumping SAM and SYSTEM but the PIN hash is not there. What mode we can use in hashcat to crack it?
Ayush Mishra's user avatar
1 vote
1 answer
107 views

Key Hash With Securely-Optimal Setting : For Encryption vs For Password

Do you have to make a key hash with securely-optimum setting (eg. 100MB memlimit, 3 opslimit) for encryption ? So I'm making a text encryption function with javascript, using XChaCha20-Poly1305 and ...
Agus Setiawan's user avatar
-2 votes
1 answer
218 views

Using base64 for secure encoding [duplicate]

Now this may seem like a stupid question, but it just occurred to me: How secure is base64 encoding compared to (plain) hashing? Nobody can read base64 code by itself, but it still isn't that hard to ...
Parking Master's user avatar
0 votes
1 answer
78 views

Saving the code of a ticket unhashed

I am making a simple ticketing system for a small local party so people can order their tickets for the party online. It works like this: The user enters his info. He pays for the ticket. If the ...
O'Niel's user avatar
  • 2,914
0 votes
1 answer
580 views

How to create a hash file of a .dmg file for use in JTR?

I have a .dmg file on my MacBook. I have forgotten the password of the .dmg file and now I'm not able to access the files in it. I tried using John the Ripper. However, whenever I run john --format=...
ange1o's user avatar
  • 1
1 vote
1 answer
490 views

john the ripper tool - how to combine wordlist with incremental modes?

In hashcat, when we need to crack password based on wordlist, but additionally want to try partly bruteforce random ASCII characters in the end of any entry from the wordlist, we can use the following ...
Hans R's user avatar
  • 13
0 votes
1 answer
153 views

Applying application-level signing in HTTP

I have to secure HTTP requests`s body on application layer, so I wanted to generate signatures with hash of body and the receiver will validate it. But I can do it in different way and apply it into ...
Szyszka947's user avatar
0 votes
1 answer
97 views

How is the npm package manager made robust security-wise, what are the keys they are using, and how do they use them?

I am specifically looking at the npm package metadata like from the lodash package, the relevant part which is this: { "shasum": "392617f69a947e40cec7848d85fcc3dd29d74bc5", &...
Lance's user avatar
  • 622
2 votes
2 answers
574 views

Where or how to persist a decryption key in a React app?

I'm making a web application on the MERN stack which stores sensitive user data, in the form of a big block of text. The encryption method I am using is that when a user registers, a random key is ...
lostCoder's user avatar
1 vote
1 answer
402 views

Is a leaked encrypted password more secure than a leaked hash?

Encryption tech is obviously intended to secure things that we want to be private over an insecure medium. When I log into a site for example, my password is transmitted over HTTPS, hashed by the ...
joshperry's user avatar
  • 391
1 vote
1 answer
282 views

Two different salted hashes of the same password for the same user

I am creating an authentication system that is able to login to the same account with different sets of credentials. I also want to allow users to login with either username or email with the same ...
the Radek's user avatar
0 votes
1 answer
173 views

Fuzzy hash of a file

Could someone please explain this to me: When you use a fuzzy hash algorithm (ssdeep, tlsh, sdhash... or any other) to calculate the hash value of a file, does it calculate the hash based on the whole ...
Moooz's user avatar
  • 35
1 vote
1 answer
411 views

What is the effect of salt and no. of rounds in mkpasswd encryption?

I'm currently trying to understand how salting and no. of rounds work using mkpasswd. These are the commands that I have been experimenting around. cp@cp-vm:~/Asg2_Task1b$ time mkpasswd -m sha-512 ...
Chloe's user avatar
  • 11
2 votes
1 answer
288 views

What are the threats of using hashing functions that are built into the DBMS? (besides man-in-the-middle attacks)

There are functions like MD5 and SHA2 in MySQL which can be used to hash values before putting them into the database, or when searching over values. As I proposed a possible solution in a comment to ...
v_slav.b's user avatar
1 vote
2 answers
164 views

What's the shortest message you need to claim ownership of another message?

Hypothetically, I'd like to demonstrate that I am the owner of a piece of published information. The requirements are the following. The hash/ characteristic string is compact enough (ideally a few ...
Boson Bear's user avatar
4 votes
4 answers
872 views

Using hashed trigrams to search over encrypted data

For practice, I write let's call it a notebook app that stores users' notes in AES-encrypted form. For encryption, I use a password-based intermediate key technique as described here. Actually, the ...
v_slav.b's user avatar
3 votes
2 answers
2k views

How can I identify the salt value used in a password hash?

I'm currently learning about password cracking, and I have a set of passwords with their respective hash values. I used Hashcat to crack the hash values, just to see how it works, but I got different ...
Anantashayana's user avatar
15 votes
6 answers
8k views

Is it possible to generate a file with a given sha256sum checksum?

Is it possible to generate a file with a given sha256sum checksum? That is, reverse the process of a sha256sum checksum. That is, if we have a checksum, can we generate txt file data (need not be ...
Amruth A's user avatar
  • 223
14 votes
2 answers
5k views

Reasoning behind banning '#' from the start of passwords? [duplicate]

Today, on an official government website, I came across the following password rules: "Your password has to be at least 8 characters long. It can't have any blank spaces. It has to use characters ...
Hazsi's user avatar
  • 141
5 votes
3 answers
533 views

Using Proof of Work to slow down login attempts

For a while I've been pondering a user authentication protocol that aims to ensure that a client does some computational work before the server will attempt to authenticate the password. The reason ...
Cruncher's user avatar
  • 153

1
2 3 4 5
46