Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
0answers
83 views

John the Ripper Obtain Password from Hash

John the Ripper 1. Ran ./pdf2john.pl /home/desktop/1.pdf > /home/desktop/1.txt (Hash inside 1.txt) 2. Ran ./john /home/desktop/1.txt Output: Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64]) No ...
0
votes
1answer
62 views

What advantage does HMAC provide in generating short hashes comparing to regular hash function?

This question is specific to the Apple/Google Contact Tracing framework. See https://www.blog.google/documents/56/Contact_Tracing_-_Cryptography_Specification.pdf for the cryptography spec. In this ...
2
votes
3answers
78 views

Password checking process for common websites

This will seem like a very basic question, but I wanted to make sure I don't miss something. When you enter your password in a login page and you press enter, what exactly happens right after until ...
5
votes
2answers
170 views

Can name and date of birth be hashed somehow to generate a secure identifier?

I'm working on a project which we intend to launch for developing countries, and, as a result, want to limit the amount of information needed for login and identification, while still maintaining ...
2
votes
1answer
87 views

Why does pwdump7 retrieve LM hashes even though they're disabled?

I'm currently undergoing a penetration testing certification, where I'm asked to : Set up a fully-patched Windows 10 Pro VM (done) Retrieve local password hashes from the SAM database using pwdump7 ...
0
votes
1answer
93 views

How to share information between devices, while keeping it anonymous

I'm developing an app for alert people if they encounter covid-19 positive person. I'm very much concern about user's privacy. So I need to make a user completely anonymous. What is want is as ...
0
votes
0answers
100 views

Safest alternative for hashing credit card numbers to use the hash as fingerprint?

Same question asked here in 2014 but since a lot has changed since then, I would like to get feedback from experts on the latest best practices. The problem We need to hash credit card numbers to ...
1
vote
1answer
152 views

Argon2id Configuration

I read an article about how to use Argon2id in C# here. Below is the code they wrote (slightly edited): using System; using System.Diagnostics; using System.Linq; using System.Security.Cryptography; ...
0
votes
1answer
77 views

Writing a Simple SHA256 Salted Hash Generator

I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications): using System; using System.Text; using System....
1
vote
1answer
225 views

Oversalting Potentially Harmful?

I find it hard to believe, and figure I just missed or forgot something obvious (years since I thought about this stuff), so maybe someone can point it out. But it seems like most of what I know about ...
0
votes
0answers
96 views

John the ripper - ecryptfs - sample not cracked: 0 password hashes cracked

I tried to use john the ripper on the sample : ecryptfs_sample_metadata.tar (password is 'openwall') Which I downloaded from here: https://openwall.info/wiki/john/sample-non-hashes If i try sudo ...
0
votes
1answer
77 views

Does TLS (Transport Layer Security) protect against deliberate tampering or accidental corruption?

If someone tampers with data being transmitted over HTTPS using TLS, would that result in a corrupted decrypted message or would it result in the error being detected such as through a cryptographic ...
0
votes
1answer
93 views

Using DD to get the hash of a non-system partition encrypted by VeraCrypt

I am trying to use DD for Windows to obtain the hash of a non-system partition that was encrypted via Veracrypt, but have run into a bit of a problem. The command I used to get the hash of the ...
1
vote
0answers
271 views

John the Ripper doesn't crack passwords when I use wordlists

Title says it all, I can't tell if John is just crashing or "gives up" on cracking the hash. First I start off by creating an md5 hash out of a word I KNOW is on the rockyou.txt wordlist: echo -n '...
0
votes
1answer
145 views

OAuth2 - Sending a hash of your client_secret when using the client credentials grant instead of the secret

I'm working on an API that I'd like to be accessible internally by other servers as well as devices that I consider both as confidential private clients. Devices are considered private clients because ...
0
votes
0answers
39 views

Are there any security implications of signing a hex digest over the binary digest?

Hash functions usually used for signing output a fixed amount of bytes. However, some tools output the data as an ASCII hex string, and other tools use the binary bytes. It is clear that from a ...
0
votes
0answers
72 views

Bruteforce different encodings

I have a hash $office$*2013*100000*256*16*664f9e0787392c2b1632d3947aaadee4*27dc7d029f76244a407acf9b5afa3740*ebbc055ae08124f6a6be81ef812da4fece16b2ad86eede3916d9cda15f71833f password: лl My wordlist:...
2
votes
1answer
119 views

What hashing strategy is recommended for desensitizing reporting data?

I need to desensitize data for reporting. There may be some PII but nothing like SSN, mostly Name or Phone. They won't be concatenated together anywhere. Also this is in the US with no European (or ...
0
votes
0answers
17 views

Does hashing client-side increase security when dealing with an untrustworthy server? [duplicate]

Does hashing once on clientside and once on server-side increase security when dealing with an untrustworthy server? For example when dealing with open source projects where users can self-host their ...
0
votes
0answers
81 views

Why is the BCrypt text “OrpheanBeholderScryDoubt”

I'm looking for a reference about the weird initial BCrypt text "OrpheanBeholderScryDoubt" Why was this string used? Would using 192 zeros or ones not have worked well in practice for some reason? ...
0
votes
1answer
196 views

Hash that outputs a 8 characters [duplicate]

I'm investigating a login system that exposes (probably) hashed passwords. Password: HTSr0MF8Ou4liOCUayXHDg== The password is stored in base64 format. When I decode it, I get random 8 chars ...
0
votes
2answers
85 views

Why hash on server instead of client? [duplicate]

Please hear me out. I used to scoff at people who asked this question because client-side hashing is "so obviously wrong." I have read similar questions on this site but haven't found a satisfactory ...
34
votes
5answers
6k views

Does it matter if a brute force search for a password returns a collision and not the password?

Assume the following very basic hashing algorithm. h(k) = k mod 17 Let's say we create a password 12345 for a website that uses this very basic hashing algorithm. That would yield the hash of 3. ...
0
votes
0answers
65 views

Why people buy stolen databases with emails and hashed passwords of users? [duplicate]

I see every now and then how hackers stole DB with emails and hashed passwords of millions of users from popular websites and sell it on the black market. I assume that passwords were hashed with ...
1
vote
0answers
88 views

Is multiplying hashes a valid way to ensure two sets of data are identical (but in arbitrary order)

Let's say "User A" has a set of data like below. Each entry has been hashed (sha256) to ensure integrity within a single entry. You can't modify data of a single entry without also modifying the ...
23
votes
13answers
8k views

How are hashing algorithms useful if the implementation is public?

I may be misunderstanding, but if I want to use a hashing algorithm such as argon2, what's stopping from someone seeing how it works and reversing what it does?
0
votes
0answers
61 views

Is the half_md4 dirent hashing algorithm a security problem in ext* filesystems?

half_md4 does not look a very strong hash for me, although googling for it does not reveal too much. I suspect, the directory entries could be organized by a half_md4 hashed hash table. If it is so, ...
0
votes
1answer
334 views

Can't solve format for Salted SHA1 hashes with Hashcat?

I am attempting to understand the format for this Salted SHA1 hash for an assignment. The line of text I was given was: nameExample@email.com,nameExample,nameExample@email.com,nameExample,,,...
1
vote
1answer
89 views

Should it be dangerous if I revealed part of a raw string of a hash?

This is a theoretical question about hashes, where I would want to know if the hash(“XY”) would be at risk if I revealed ‘X’. Where X can be a substring. Considering the most perfect hashing algorithm ...
0
votes
0answers
25 views

What type of encoding is this string? [duplicate]

I have an encoded string: VH+_+smN+IPimspbC+_+ygX73g== The original string is: 51756 So 51756 => VH+_+smN+IPimspbC+_+ygX73g== What is the encoding algorithm type? How can decode VH+_+smN+IPimspbC+...
0
votes
2answers
179 views

How can I give out a secret to the public that only I can decipher?

I wish to add an extra layer of security to my product (web app that people download and install on their server) that have a module that allows me, the developer, to access their sites instantly with ...
48
votes
8answers
10k views

Can you find out how big the changes are by comparing two hashes?

I realize that a hash function is a one way function, and that changes in the hash are suppose to tell us that the original data has changed (that the entire hash changes on even the slightest changes ...
2
votes
2answers
852 views

dictionary attack hashing algorithm

Does the kind of algorithm used to hash passwords have any advantages or disadvantages in a dictionary attack? i.e. SHA256, MD5, etc. or is it just the dictionary that is used by the attacker matters? ...
0
votes
3answers
98 views

What is the point of using stronger hashes?

If hashes cannot be decrypted, then what is the point of using stronger hashes? Since are only uncrackable via brute force through hashing the text and comparing the hashed password, won't it be ...
1
vote
1answer
63 views

How can I validate that a PRNG's output is insecure and predictable?

Say I talk to a developer who is using some output of a Pseudo-random number generator in order to do some security task. I know based upon common knowledge that only Cryptographically Secure Pseudo ...
-1
votes
1answer
60 views

Using a Pepper as the index to insert a salt

In this question on this board the author of the selected answer states the following. If you, as an attacker, manage to extract hashes and salts from a database, you probably either find a way to ...
0
votes
1answer
109 views

Cracking less than 4 letter linux password using john

I am trying to crack a less than 4 character Linux password using john. I unshadowed my password into file.txt I use the following command: john -incremental file.txt the output is: 0g 0:00:00:04 ...
0
votes
0answers
57 views

Issue using John The Ripper

First things first, I'm a newbie so, bear with me... I created a word list with a combination of a possible password for a certain user using Crunch (it's the dictionary output) and need to use John ...
1
vote
1answer
94 views

Hashing sensitive data and checking for duplicates

I have some sensitive client data that needs to be hashed, but I also need to check that that data isn’t duplicated by another client. So the hash function needs to produce the same value for the same ...
0
votes
1answer
223 views

How to find just the first character or value of a MD5 hash string

I want to know how to find just the first character or digit in first part of a 64 length string from a MD5 hash. For example, we have a hash: ...
0
votes
2answers
212 views

How to preventing timing attacks against values used for authentication, like emails, stored in Databases?

I am building a web app that allows login with an email and password. I understand that I need to use a timing safe function to compare the passwords to prevent timing attacks. However I realized that ...
0
votes
2answers
79 views

Improving security by altering size of hash strings [duplicate]

So I was thinking, if people get access somehow to your list of hashes, it's easy for them to figure out what alghoritm you used if they have 32, 40, 60 characters etc But what if you slice those ...
0
votes
4answers
464 views

Password hashing that is resistant to ASIC-assisted cracking without risking DoS of server

Previously, authentication systems stored passwords in cleartext. This made it trivial for an attacker to log in to an account if he had access to a leaked password file. Later, passwords were hashed ...
2
votes
2answers
105 views

How does password-append OTP validation work?

Recently when I was changing some Amazon account settings, I've noticed that they provide an option to validate the OTP by appending it to the password. How would this work, if the password is one-way ...
1
vote
0answers
59 views

Store passwords local with plain text access on WinPE

I have an application that needs to store Network Credentials for a Network Drive/Share on the disk. The user shouldn't need to enter the password every time. The OS is WinPE, so he cannot map the ...
1
vote
2answers
196 views

PBKDF2 hash over PBKDF2 key derivation

Imagine an app where any user provides a username and a password. This password is used to generate a 'strong' encryption key (for AES encryption) with the PBDKF2 key derivation algorithm. This ...
0
votes
1answer
165 views

How to securely store decryptable passwords

I'll quickly outline the purpose of our application: The user logs in using his username and password. He will receive a list of servers he can connect to. After choosing a server the connection to ...
0
votes
2answers
99 views

Theoretically, If you know the hash of a program one intends to install and you generate another file that hashes to that value what could you do? [closed]

If I know the hash of a program you intend to install is d306c9f6c5..., if I generate some other file that hashes to that value, I could wreak all sorts of havoc. - from https://nakamoto.com/hash-...
2
votes
1answer
71 views

How to ensure authenticity and integrity of a directory

I want to do something similar to Ubuntu's signed checksums in distribution and I'm currently stuck on the integrity part. The tutorial here covers most of what I'd like the process to look like (I've ...
2
votes
1answer
205 views

Storing Argon2id parameters in a database?

I've decided to use Argon2id for storing users' passwords in my database. I have two questions: Because there are several input parameters (parallelism, iterations etc.) that can influence the ...

1
2
3 4 5
40