Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
1
vote
1answer
3k views

Understanding ANSI/AAMVA encoded data (pdf417 data matrix) on back of NYS ID card

Background I am developing an Android application for work which runs on a Zebra TC51 bar code scanner, which I have been playing around with.. I scanned my NYS drivers license and inspected the ...
4
votes
2answers
2k views

Is there a good 160 bit alternative for SHA-1?

SHA-1 has long been considered insecure, and now the attacks have been demonstrated in practice also. The proposed alternative for SSL certificates is the SHA-2 suite of hash functions, of which SHA-...
2
votes
1answer
397 views

John The Ripper Error: No password hashes loaded when cracking a zip file in kali linux

I was practicing bruteforce attacks using John The Ripper. I want to crack a zip file. I obtained the hash and stored it in a zip file but when I attempt to crack the zip file it is giving me an error ...
3
votes
1answer
2k views

Are there any known MD5 hash collisions of messages of different length?

All the examples of MD5 hash collisions I've come across comprise two different messages (inputs) of the same length. The first and second messages have different values for a number of bits and the ...
3
votes
2answers
104 views

Why should I go to SHA512withRSA signature for my Android apps?

I have an Android 11 device and many of my apps and system apps use MD5withRSA or SHA1withRSA as signature algorithm by default. Why should I take my apps SHA256withRSA or SHA512withRSA? Are there any ...
1
vote
1answer
72 views

Why the need to hardcode passwords? [closed]

Many IOT devices and routers manufacturers hardcode plaintext default passwords in their devices. Why don't they store the hashed password instead? For what functionality do they need the plaintext ...
5
votes
1answer
618 views

Safety of barcode checksums

A company is handing out gift vouchers with a unique code128 barcode. The barcode consist of 12 fixed characters containing meta information and sequence number plus a 4 digit checksum. For example: ...
1
vote
2answers
124 views

Why don't companies just tie the password to the user name?

One problem with passwords is that if they can be broken as follows: pick a random password hash it compare that hash to other known hashes This way, you have broken the password. Then if you can ...
0
votes
1answer
69 views

What is the relation between “signature_algorithms” handshake extension and TLS ciphersuite

I am learning TLS handshake and find client/serve will negotiate a cihpersuite during client/server hello. Usually, the last part of a ciphersuite is a hash algorithm, like SHA256 in ECDHE-ECDSA-...
0
votes
3answers
101 views

How to verify integrity of software when the download provider doesn't publish hashes?

I noticed that certain software does not provide hash anymore nowadays. E.g. Zoom https://zoom.us/download wolf@linux:~$ ls -lh zoom_amd64.deb -rw-rw-r-- 1 wolf wolf 44M Jan 1 00:00 zoom_amd64....
23
votes
8answers
3k views

Is a simple, but very long password a good password?

Is a password like wwwwwwwwwwwwwwwwwwwwwwwww9 (25x 'w' and a number) secure? It would be easy to remember.
8
votes
7answers
5k views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
1
vote
2answers
67 views

Enpoint protection: How to search an organisation for hash value

As part of incident response to malicious code outbreak and given the hash value of the malicious artifact, I would like to search across the entire organization for this specific hash value. Do you ...
0
votes
1answer
68 views

How password_hash / password_verify can work with any arguments (PHP)

I already know how to use password_verify and password_hash functions, but I don't really understand how they work. When I use them I do something like that: $save_hash = password_hash( $password, ...
1
vote
2answers
678 views

What if the Local Windows Cert Store is Compromised?

The diagram below illustrates chaining digital certificates up to a publicly trusted Root Certificate: (source: globalsign.com) I have been researching how trusted root authorities (such as ...
2
votes
1answer
94 views

Can Hash Length Extension attacks be avoided by changing the data structure?

I read about Hash Length Extension attacks here and here. From the articles I gained that this attack relies on the data structure, in the way that the secret has to be prefixed to the data (please ...
0
votes
1answer
43 views

How to identify this hashed text and if it encrypted using a key? [duplicate]

I have 2 hashes which I don't remember which type of encryption I used or if i used a secret key. can you help me identify these I will just give all details but not paste the whole hash here. hash1 ...
8
votes
1answer
1k views

What are the minimum parameters for Argon2?

Argon2 is the winner of the Password Hashing competition, and currently recommended by OWASP for secure storage of passwords. One crucial step of Argon2 is determining the parameters used by the ...
1
vote
0answers
25 views

How to assess security of Argon2 parameters [duplicate]

I would like to hash user password with Argon2id, then use this hash as ECDSA private key. I made some tests with Python and passlib.hash and found following parameters: memory: 32 MB iterations: 100 ...
25
votes
13answers
8k views

How are hashing algorithms useful if the implementation is public?

I may be misunderstanding, but if I want to use a hashing algorithm such as argon2, what's stopping from someone seeing how it works and reversing what it does?
1
vote
1answer
464 views

Postfix + MySQL ENCRYPT() encryption method change

I already have my mail server (postfix, courier, mysql) and roundcube as my webmail client, Encrypt() is the current password encryption function, Is there a way to change the default password ...
6
votes
1answer
30k views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? ...
0
votes
2answers
160 views

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here, the hashsum are made part ...
2
votes
1answer
68 views

one-way hash with PhP onto MySQL database (NOT for password)

My users (researchers) will be storing where their website is on a mysql database on my server. Ideally I want to hash the locations so that when the researchers' participants submit their data to my ...
2
votes
1answer
99 views

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
0
votes
1answer
34 views

Generating tokens via PRNG and Hashing

We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it Step 1: Generate a random number using a good a CSPRNG ...
8
votes
4answers
2k views

Alternatives for sending plaintext password while login

Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
2
votes
1answer
78 views

how message authentication code share keys?

How are secret keys shared between receiver and sender, especially when we want to have confidentiality that sender and receiver are using two keys, one for MAC algorithm and one for encryption and ...
1
vote
2answers
789 views

Are all fields of the PE certificate directory hashed during authenticode signing?

In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
0
votes
1answer
1k views

Session hashes - how it works?

There's a website I visit and I can't understand fully the login process and session hash it creates and uses to keep track of logins and such. Would someone help me understand what goes on in server ...
0
votes
2answers
86 views

Private key Proof of Ownership [closed]

Given 2 entities, A and B: A has a public key( x ) and a private key( x* ). B has a A's public key hash( let's call it h(x) ). A has to prove ownership of x* to B. How could this be achieved, ...
22
votes
7answers
8k views

Convenient cross-platform help on checking secure hashes like SHA-256

It is often helpful to be able to obtain a good cryptographic checksum of a file, e.g. the SHA-256 hash. This can be used to verify file integrity, so long as you have a reliable source for the hash. ...
1
vote
1answer
96 views

Is md5(data + key) secure if a proper hmac function isn't available?

I need to generate a MAC signature for data on a website, but it's in a HTML templating system where there's only a few functions available. The only hashing function available is md5. Ideally, I'd ...
7
votes
3answers
7k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...
46
votes
5answers
58k views

openssl: recover key and IV by passphrase

A large amount of files were encrypted by openssl enc -aes-256-cbc -pass pass:MYPASSWORD Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
1
vote
1answer
44 views

What do algorithms `128000` and `256000` do in `sha3sum`?

I wanted to try new sha3sum so I installed libdigest-sha3-perl on Debian 10. After reading man page I quickly realized that: sha3sum --algorithm 256 test.txt produces similar output to sha256sum and ...
0
votes
1answer
378 views

Using DD to get the hash of a non-system partition encrypted by VeraCrypt

I am trying to use DD for Windows to obtain the hash of a non-system partition that was encrypted via Veracrypt, but have run into a bit of a problem. The command I used to get the hash of the ...
-1
votes
4answers
2k views

Theoretical - Password salting with concatenation vs. salting with HMAC

I was looking through different methods of salting and tried to compare which is more secure for password storage. I know HMAC wasn't meant at first for password hashing but it is widely used for that ...
0
votes
0answers
21 views

Time it will take to crack a password file? [duplicate]

I'm trying to answer a multiple-choice question which is the following: "Consider the security of a password file, which includes a 10 bit salt and all passwords are hashed, but known to consist ...
3
votes
3answers
462 views

Secure preshared key 2 way authentication

I have the following setup: A server and a client will be connected over tcp. The server and client both have access to the preshared secret key. When the client connects to the server, the client and ...
2
votes
2answers
86 views

Appropriate length and slow, unsalted cryptographic hash function for random codes?

Given the following situation: we have sensitive information and want to give a user access to it. At this point the user might not have interacted with our system yet. We generate a random code that ...
3
votes
1answer
84 views

Fail to understand how hash length extension might work in real application

I'm trying to understand how the hash length extension might work on real web applications using a hash for MAC. Especially what I don't get is, how the application considers the evil forged hash ...
0
votes
0answers
50 views

Running Responder outputs many hashes per user, how is this possible?

I am running Responder on Kali Linux within a client network using the following command sudo responder -I eth0 -w -r -d which is capturing many hashes in the environment. Responder is a LLMNR, NBT-...
1
vote
0answers
50 views

Good use of libsodium?

I am looking to hash user passwords to store in a database that will likely reside on a user's intranet, so I am expecting the database to be classed as open and insecure. I am using libsodium 1.0.18 ...
1
vote
1answer
89 views

How to confirm the last entry of a linked hash list

We use a linked hash list for data integrity. Content is hashed (HMAC-SHA256) and stored in a block that itself is hashed and referenced in the next block: Simplified example: ... { id: "...
189
votes
6answers
37k views

Does Facebook store plain-text passwords?

I was about to reset my Facebook password and got this error: Your new password is too similar to your current password. Please try another password. I assumed that Facebook stores only password ...
7
votes
1answer
1k views

Is MD5 hashing possible by divide and conquer algorithm

I would like to compute the MD5 hash of a file The file is uploaded to my webserver by my clients The file is uploaded in pieces (called chunks) The client also sends the md5 hash of the file so that ...
2
votes
2answers
106 views

Use delay with a fixed total time to defend against timing attacks

Consider this common example used to demonstrate timing attacks: async def sign_in(username, password): user = await get_user_from_db(username) if user is None: return False # early return :(...
2
votes
1answer
12k views

How to brute-force WPA-2 password of specific set of characters using oclHashcat?

I want to test oclHashcat on a WPA-2 PSK password of length 8 containing only characters in the set {a-z, A-Z, 0-9}. To do this I have already captured the handshake in a .cap file and converted it ...
1
vote
0answers
43 views

Hashing of password in banking mobile app

Do I have to hash passwords on the client side of a banking mobile app since i am using a SSL network to send the password to the server end for hashing. Can the password be intercepted before ...

1
2
3 4 5
42