Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
1
vote
1answer
89 views

How to confirm the last entry of a linked hash list

We use a linked hash list for data integrity. Content is hashed (HMAC-SHA256) and stored in a block that itself is hashed and referenced in the next block: Simplified example: ... { id: "...
7
votes
1answer
1k views

Is MD5 hashing possible by divide and conquer algorithm

I would like to compute the MD5 hash of a file The file is uploaded to my webserver by my clients The file is uploaded in pieces (called chunks) The client also sends the md5 hash of the file so that ...
1
vote
2answers
67 views

Enpoint protection: How to search an organisation for hash value

As part of incident response to malicious code outbreak and given the hash value of the malicious artifact, I would like to search across the entire organization for this specific hash value. Do you ...
0
votes
1answer
34 views

Generating tokens via PRNG and Hashing

We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it Step 1: Generate a random number using a good a CSPRNG ...
1
vote
0answers
43 views

Hashing of password in banking mobile app

Do I have to hash passwords on the client side of a banking mobile app since i am using a SSL network to send the password to the server end for hashing. Can the password be intercepted before ...
2
votes
1answer
80 views

Can a truncated crypto hash of a truncated crypto hash help harden a resource against attacks?

In a project of mine, I have two fields which I need to use for storing a cryptographic signature (hash) of a file, but I can only use 112 bits in total, spread as 16+12 hex chars in those two fields. ...
0
votes
0answers
45 views

Storing account data on device

I am trying to make an app that allows the user to connect to a service through an API I am also developing. All passwords and account data are securely stored on the server. However, how should I ...
0
votes
1answer
52 views

Is client-side hashing secure during password creation when verification is still done server-side?

Trying to do this to distribute the work of creating a lot of users in which their passwords are hashed. This will cause the server to do a very large amount of work. The idea is this: (Assume ...
0
votes
0answers
165 views

John The Ripper: “no password hashes loaded (see FAQ)”

I'm trying to use John The Ripper to crack a private ssh key I generated with ssh-keygen. I think I've seen and read every guide under the sun, and I've managed to get as far as a string john the ...
0
votes
1answer
106 views

How is the bcrypt algorithm decrypted? [duplicate]

I have a ton of hashed texts and their decrypted or de-hashed forms (I don't know which term is suitable in this case) via bcrypt. The thing I want to learn is how they are decrypted. For example, the ...
0
votes
1answer
158 views

How does john the ripper crack hashes using wordlists?

How does John The Ripper work when trying to crack passphrase of a private ssh key? As in what steps are involved when it tries to do so? What's the role of ssh2john in the whole process?
3
votes
1answer
84 views

Fail to understand how hash length extension might work in real application

I'm trying to understand how the hash length extension might work on real web applications using a hash for MAC. Especially what I don't get is, how the application considers the evil forged hash ...
0
votes
0answers
287 views

crack MySQL323 hash

I'm trying to crack a MySQL323 hash and I'm unable to get it done. I was able to confirm tye hash type: I came across https://www.tobtu.com/mysql323.php. I can run it as "mysql323 32.exe" [...
21
votes
3answers
4k views

Does complexity of salt in password hashing matter?

I have no cyber security knowledge whatsoever, and am trying to safely store passwords in a database. I understood I need to use salt, to avoid rainbow table attacks and to make sure two users with ...
0
votes
0answers
19 views

Found out that a paid VPN service emails plaintext passwords [duplicate]

I recently found out that a VPN service does not hash their customer passwords and I need professional insight on how to deal with this. Here's how I found out: Bought a subscription on the wrong ...
0
votes
0answers
84 views

What is the point of hashing an API key?

Within my API backend i have a unique KeySalt for every API Key public string Key { get; set; } public byte[] KeySalt { get; set; } public string KeyHash { get; set; } When the user creates a new ...
0
votes
2answers
164 views

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here, the hashsum are made part ...
2
votes
2answers
142 views

Is using PBKDF2 good protection against brute-force attacks on web application login pages?

We've recently had a penetration test for one of our applications. The Penetration Testing company identified that our application lacks protections against brute-force attacks on the login page. Ref: ...
0
votes
0answers
71 views

Is caching the credentials hash and auth result secure?

I have an API that is handling a lot of volume and is using Basic authorization. This is causing me some performance issues and I'd like to move to token based auth but for various reasons, including ...
2
votes
1answer
90 views

Password salting vs. length extension attacks

I read that when salting passwords, it is advised to use a h(pwd||salt) construction instead of h(salt||pwd), the latter being vulnerable to a length extension attack. What are possible scenarios in ...
0
votes
0answers
68 views

Discover AD accounts with LM Hashes

During a recent security audit, we found that a handful of accounts still have credentials identified as stored in LM hash format. For us, these were ancient service accounts and the like - easy ...
-3
votes
2answers
228 views

When will hashing no longer be useable? [closed]

I'm curious about hashing, because normal hashing is static, it means that a string that gets hashed will always be the same (except for using salt). Because of that situation, there are many websites ...
0
votes
1answer
731 views

What is the plaintext password of 'hash part 1' in the shadow file?

on immersivelabs lab Password Hashes II https://dca.immersivelabs.online/labs/password-hashes-ii/ there is a question: What is the plaintext password of 'hash part 1' in the shadow file? shadow.txt ...
0
votes
1answer
99 views

Is this Wikipedia article about SCRAM wrong?

At my Company, we put a honeypot in our network and it raised us the Lansweeper SSH password used to connect to the scanned assets (and it is reusable over many boxes...). So it is a way for an ...
22
votes
3answers
6k views

What's a “safe” URL shortening algorithm?

The situation: Currently, we are sending out emails and SMS to our users, which include a link to a form that each user has to fill out on a regular basis (an "eDiary"). As we need to be ...
14
votes
7answers
3k views

Timing attacks in password hash comparisons

I had a discussion with a friend today about his password hash comparison. I argued that you can't return false on the first hash mismatch you have and I sent him a link to an article about a Java ...
2
votes
3answers
136 views

Cryptographically prove open sourced source code of server

I want to prove that the source code I am using is the same as the open-sourced version, which is publicly available. My idea was to publish a hash of the open-sourced version and compare it to the ...
1
vote
2answers
179 views

Encrypting a password with its own hash

I just found out that an e-commerce platform (similar to Shopify) I was planning on using allows me to see my password. I know I can't assume anything and I should (probably) just run away from it, ...
0
votes
1answer
78 views

Main Reasons for GPG over hashing for verification

I have recently been introduced to GPG signing as a better way of verifying data than hashing. It was described that if you posted the hash of the file, someone could hack your website, alter the hash ...
0
votes
0answers
88 views

how to document and check apt inrelease files? are there blockchain records for that?

apt InRelease files update like twice every day, in ubuntu repositories and their mirrors. similarly in ubuntu and debian based distros, and other apt repositories. these files are small text files ...
9
votes
2answers
2k views

Should http basic auth passwords be stored hashed serverside?

HTTP basic auth sends credentials un-hashed and unencrypted over the wire, relying on TLS for confidentiality in transit. However, should the password be stored hashed using a standard KDF in the ...
0
votes
2answers
94 views

Is adding encryption before hashing more secure?

One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value. Does encrypting the password || salt then ...
48
votes
2answers
12k views

Magic hash attack in JavaScript

In PHP a magic hash attack happens when loose type comparisons cause completely different values to be evaluated as equal, causing a password "match" without actually knowing the password. ...
0
votes
1answer
48 views

Locking accounts using the same strong hash in the database

A website has some bruteforce prevention for logins, and I need to turn that off because it's buggy and it's causing problems. It will stay turned off, probably forever, because there are no plans to ...
0
votes
1answer
98 views

Modifying a SHA256 system to be ASIC resistant

I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant. ...
2
votes
1answer
107 views

How likely is to have a hash function output flip a bit?

I was looking into this code base (https://github.com/vstoykovbg/doubleslow) and the following phrase caught my attention: DANGER of catastrophic data loss! One bit flip (due to cosmic rays for ...
0
votes
1answer
77 views

Avoid strong password hashing functions aiding a DDoS attempt on oneself [duplicate]

While reading this question, it got me to thinking. Let's say an attacker has some way to make all of their login attempts appear legitimate - enough IP addresses to never reuse them, different valid ...
0
votes
2answers
68 views

What can you do to make a hashed token database retrievable at a later date?

I have a table for single use tokens, and one of the columns is a token_digest which contains a bcrypt hash of the access token. Since the token_digest is a salted and hashed version of the plaintext ...
1
vote
2answers
293 views

What's the difference between these MD5 hashes?

What's the difference between this format: Hash found: admin:$1$$oLN1UCc1Y3T30QkMcKMSx0 and the following: 5f4dcc3b5aa765d61d8327deb882cf99 And also, How to turn the first hash format into the ...
2
votes
0answers
483 views

Recovered a 7z password with hashcat, but it's not the right one

I am trying to recover a 7z file, but have forgotten the password. It's completely AES-256 encrypted (i.e. not even the filenames are available). Steps: Generated hash file with 7z2hashcat.pl Ran a ...
0
votes
2answers
89 views

Is it unsafe to have some users with passwords and some without?

I'm working on an app where some accounts use passwordless authentication by email (using magic links) and some require a password to login. Is it okay to represent this rule in the account table by ...
0
votes
0answers
60 views

Can a secure key-exchange algorithm replace hashing for password authentication?

Over the weekend I was thinking about the problem of scaling various web services. One common practice to scale authorization is to use cryptographically signed tokens. This way when a request comes ...
0
votes
3answers
124 views

How does memory-hard hashing passwords protect against brute force attacks?

I have a background in web app development and I'm trying to up my security game but there are some things that I find confusing. Like how does memory-hard hashed passwords protect against brute force ...
0
votes
1answer
178 views

Certificate Signed Using Weak Hashing Algorithm impact on a workstation

I did a vulnerability scan on some of our company workstations. These are workstations used by employees (dev, HR, accounting, etc.) to do their job. One of the common result I found is SSL/TLS ...
1
vote
1answer
352 views

How to apply custom filters for John The Ripper when cracking RAR3 archive password?

My problem is that I'm trying to crack RAR file with is encrypted with RAR3 encryption. Decided to try with John The Ripper. Here are clues I have from my friend. Max password length is 8 Only ...
0
votes
2answers
99 views

How is CSR encrypted?

Using openssl to generate a CSR: > openssl req -newkey rsa:2048 -nodes -keyout key -out mycsr.csr It outputs the mycsr.csr file along with the key file. The content of mycsr.csr: -----BEGIN ...
0
votes
0answers
129 views

Is it safe to use HMAC to create an API key?

I am planning to create an API key using the user's password as message and a random number assigned to that user in my database as key (or vice-versa). I will then store the hash of that API key in ...
14
votes
13answers
9k views

Couldn't we create a string that produces the same hash as another string in SHA-256?

Let's say we have a separate hashing algorithm called s2 and it would convert Hello into dug84nd8. If we could take the algorithm and just reverse engineer it to generate a string like 8GN492MD that ...
0
votes
2answers
161 views

Encrypting a salted password hash with RSA before storing in a database [duplicate]

Why is it a bad idea to encrypt a salted password hash with RSA (or maybe other public-key algorithm) before storing it?
0
votes
1answer
154 views

Encrypting salted password hash before storing in the database

I have read here and here, that instead of using pepper, it is better to encrypt hashed/salted passwords before storing in the database. Especially with Java, as there's no library for salt/pepper, ...

1
2
3 4 5
42