Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

71 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
0answers
395 views

Is there any merit to the RFC 3414 (SNMPv3 User Security Model) password-to-key method?

RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at ...
4
votes
0answers
1k views

How exactly does “Apache Shiro's” hashing work when using a Desktop-Client

I was looking at this question How does storing hash passwords work? and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. ...
2
votes
0answers
115 views

How does Veracrypt work?

I’m a layman in security and was trying to understand how hashes and encryption algorithms are used in Veracrypt/Truecrypt. Reading the documentation, this is what I understood (please, feel free to ...
2
votes
0answers
67 views

Add additional rounds on existing SHA-512 salted hashes without knowing clear text password?

Assuming you have a salted SHA-512 password hash with 5000 rounds. For example: {CRYPT}$6$rounds=5000$6835c5dcf0bb7310$hVod/jy7uONMSa.FVpLHb/2OrWpAj3lB/....
2
votes
0answers
72 views

Extracted LM Hashes doesnt match actual password

I'm new to LM Hashing and Windows authentication, and I'm having problems with LM hashes. I've created 2 accounts with the password "123", and both of them have different hashes, and none of the ...
2
votes
0answers
105 views

Strategy regarding an (almost always) offline app

I'm currently in internship in a software/app development company, where I have to come up with an idea about how can we handle the fact that the user will mostly use an app offline. Basically, the ...
2
votes
0answers
331 views

OAuth2 password analog (private, unique, & static) – Encryption

I’m making a webapp which encrypts each user’s data, using AES-256, with a unique key for each account. I’m thinking about adding external signon via the “Sign in with Google” scheme. However, I’ve ...
2
votes
3answers
346 views

Secure preshared key 2 way authentication

I have the following setup: A server and a client will be connected over tcp. The server and client both have access to the preshared secret key. When the client connects to the server, the client and ...
2
votes
0answers
428 views

Mimikatz hash dump of logged-off users

If I want to dump hashes of domain users on my computer, do they have to be logged on, or can I dump hashes of logged off users? When I try mimikatz in my lab, I can only get dumps from others users ...
2
votes
0answers
220 views

The optimal settings of Winrtgen GUI

I'm working with Winrtgen GUI on windows, but I can't fix the right settings to create a rainbow table for a: password length=1-7 Charset=alpha numeric all space What are the ideal values to put in ...
2
votes
0answers
447 views

CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
1
vote
1answer
96 views

BIOS password hash

Is it possible to find the BIOS password hash in a BIOS dump and decrypt it? For instance, a person could use flashrom Live CD to dump the BIOS with flashrom -r but how would you find the BIOS ...
1
vote
0answers
58 views

When knowing an individual's plaintext password history, how much information is expected to be gained with a new password? Do we know this?

The premise: Knowing a persons password history should provide information to help when guessing a new password of theirs. At an extreme end, with a password history of wildcats, wildcats1, then ...
1
vote
0answers
34 views

Manipulation-save logging

I have to keep a journal of all transactions that are performed in my application. Think of an invoice journal. What options do I have? E.g. an option in syslogd, or a table configuration in MySQL ...
1
vote
1answer
92 views

Schemes for ID obfuscation like Facebook app scoped IDs

After certain privacy concerns Facebook rolled out a bunch of changes to their APIs, one being "scoping" user identifiers per app. In effect, this means that Alice's canonical facebook user ID is ...
1
vote
0answers
37 views

Rotating session names vs a static session name with a rotating validation string

I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon ...
1
vote
1answer
95 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
1
vote
0answers
44 views

Increase password iterations?

Is it possible to strengthen the macOS login password by increasing the number of sha-512 iterations?
1
vote
0answers
93 views

How do I examine a fresh Windows 10 installation

I suspect an unauthorized modification has been applied to a fresh new installation of Win 10 x64 and/or a PC running it by a person who knows me personally with the purpose of tracking my activity ...
1
vote
0answers
85 views

Restrict Public API To Access From Single App

I have a REST api on a server and an application for android phones that mostly makes calls to that api and presents the info to the user. Because the application needs to be a quick way to lookup ...
1
vote
0answers
67 views

Re-using the hash value of password to server by malicious actor

Let's say Alice logged into https://www.facebook.com with her email and password: Email: Alice@gmail.com Password: correctHorseShoeBattery Nonce given by ...
1
vote
0answers
59 views

Get Hash from OS X-Encrypted USB Drive?

I have a personal USB that was encrypted using Disk Utility on OS X 10.11 El Capitan using AES-256 encryption. I no longer have the password, but I have a list of likely prefixes that were used, ...
1
vote
0answers
2k views

Using PBKDF2 for hash and AES key generation implementation

I am writing a Java application that is required to locally authenticate a user with a password and then use the password to generate an AES-256 key for local file encryption/decryption. I understand ...
1
vote
0answers
60 views

Can Hash Length Extension attacks be avoided by changing the data structure?

I read about Hash Length Extension attacks here and here. From the articles I gained that this attack relies on the data structure, in the way that the secret has to be prefixed to the data (please ...
1
vote
0answers
522 views

Different CRC32 implementations? different results?

So recently I managed to implement the Caffe-Latte attack in python. I got stuck for two weeks because the final ICV wouldn't match. After some digging around I found that airbase-ng (which already ...
1
vote
0answers
2k views

How to reasonably hash a composite key into a UUID?

The Problem In our system users are identified by a composite key. We'd like to devise a scheme to deterministically convert this composite key into a UUID. Solutions? The obvious first suggestion ...
1
vote
0answers
69 views

Detecting cloaking at the client side

According to this paper(reference: section IX), it may be possible for clients to detect cloaking. It basically says, whenever you fetch a page from a url(assumed to clicked from the search results),...
1
vote
0answers
264 views

How to cache auth credentials to speed up authentication

I'm developing some REST API that requires a HTTP basic auth to access. The APIs are written in Django, and the auth is based on Django auth middleware that is: it checks against the DB, the username ...
1
vote
0answers
223 views

Digest algorithm for the PRNG in OpenVPN

Considering the following OpenVPN (2.4) option from the manual: --prng alg [nsl] (Advanced) For PRNG (Pseudo-random number generator), use digest algorithm alg (default=sha1), and set nsl (default=16)...
1
vote
0answers
343 views

Postfix + MySQL ENCRYPT() encryption method change

I already have my mail server (postfix, courier, mysql) and roundcube as my webmail client, Encrypt() is the current password encryption function, Is there a way to change the default password ...
1
vote
0answers
218 views

Use Burp to fuzzy test the hash value (the values after the # in the URL)

I know its possible to use a tool like Burp to test Cookie/post/get values , but is it possible to use such tool to perform a brute force/dictionary attack (fuzzy test) on the values after # symbol. ...
1
vote
0answers
165 views

Can an rdiff signature of a file be made public without disclosing non-public information?

I'm building a system which involves passing around what are essentially uncompressed TARs of linux userlands including some additional private files. An original file (X) is sent to a worker, and the ...
1
vote
0answers
94 views

Using hash of root password to encrypt files/folders (Debian 8 Linux)

I have an application that requires unattended decryption of files/folders. Would it be possible to utilize the hash of the root password to prevent an attack where a malicious user changes the root ...
1
vote
0answers
542 views

HMAC Token - Check Logic

I have a situation where I need a token that provides authentication. The common HMAC procedure I found is: Get Some key using login credentials Create Message, append key and other message data (...
1
vote
0answers
52 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
1
vote
0answers
299 views

SHA1 and SHA256 initial digest to start from

Let's say I have: C = A + B where A and B contain strings and the plus sign means concatenation. I already hashed A with SHA1 and SHA256 and got a digests. I forget what the original A string was, but ...
1
vote
0answers
187 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
1
vote
0answers
1k views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
1
vote
0answers
853 views

John The Ripper and OpenCL on AMD FirePro

Trying to work with John 1.8.0 Jumbo 1 I noticed that OpenCL won't work for me. I used autoconfig (meaning configure and build with the option to enable OpenMPI) in order to build JTR for my Mac Pro. ...
1
vote
0answers
443 views

PKCS#7 signed data structure in signed PDF document

Is it mandatory to include PKCS#7 data (OID 1.2.840.113549.1.7.1) octet string into the sequence of PKCS#7 signed data? I mean if you want to sign PDF, you are basically adding PKCS#7 container ...
1
vote
0answers
2k views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
1
vote
0answers
113 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
1
vote
0answers
289 views

Persistent login by hashing password hash

It seems that persistent logins are technically the same as storing a password on the client, and therefore should be avoided whenever possible. However, real life users would be unhappy with having ...
1
vote
1answer
375 views

How to crack a list of hashed passwords given their possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256 using some java code. I have the hashes available and I also have the possibilities in which the password can be. Some ...
0
votes
0answers
70 views

Where are NTLM and LM hashes stored in a password protected microsoft presentation file

I have a password protected presentation file (MS office 2003). My assignment required me to either remove the password or find it. In my research i found out that presentation use ntlm and/or nt ...
0
votes
0answers
187 views

Problems relaying NTLMv2 with Responder and MultiRelay

I'm currently experimenting with mitm relay attacks using Responder.py and MultiRelay.py tool and running into problems. I have the following LAB setup: Kali Box: IP: 192.168.1.13 ...
0
votes
0answers
74 views

What prevents the client from changing the signature in files?

From what I can tell, some software licenses work client side. For example, when looking in to the purchased software for the first time, the server will return a software license. In order to ...
0
votes
0answers
40 views

Is there a protocol fuzzer or fuzzing framework that uses cryptography?

When reading about fuzzing, the way to go seems to ignore checksums and cryptographic integrity protection or at least circumvent verification procedures via a 'fuzz-friendly mode'. For black-box ...
0
votes
0answers
111 views

Is gnupg2 --refresh-keys susceptible to any attacks based on fingerprint collisions?

Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys Mallory ensures that Bob uses her keyserver, which offers her own key, which is sharing the 32-bit "short" Key ...
0
votes
0answers
323 views

bcrypt.checkpw() returning true for different salt+hash

new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...