Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
1answer
53 views

does computing hash takes metadata into account?

I am currently trying to create a scan system, which identifies files that have been modified since the previous scan. It will work on some directories/files and identify the content which have been ...
0
votes
0answers
74 views

What prevents the client from changing the signature in files?

From what I can tell, some software licenses work client side. For example, when looking in to the purchased software for the first time, the server will return a software license. In order to ...
0
votes
0answers
25 views

if password hash algorithm is broken, is best practice to re-hash the hashes with a new hash? [duplicate]

Suppose you store a bunch of hashed passwords, but your hashing algorithm gets broken. What is the best practice? It seems like the only safe practice would be to take the old password hashes (...
0
votes
1answer
244 views

WebGoat 8: JWT Tokens Lesson 5 using hashcat to crack signature [closed]

I cracked the hash, and I got this: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9....
2
votes
1answer
96 views

Plausible way to hack website keeping [username / hashed password] pairs?

I was reading that a lot of authentication systems use cryptographic hash functions, whereby instead of keeping the username and password of their users they just keep the username and a hash of the ...
0
votes
1answer
129 views

Why does Google still use SHA-1 for securing API keys if its been compromised?

If you read Google's best practices for use account you'd see them warning against using SHA-1. They have even purposefully cracked it in 2017. If that's the case, then why when you restrict google ...
1
vote
1answer
129 views

Using BITMAIN AntMiner L3+ for cracking password [closed]

I want to use a BITMAIN AntMiner L3+ miner to crack passwords. How can I do that? Can I install hashcat agent to L3+ ?
0
votes
1answer
87 views

Decrypt hash using dicionary attack

Let's consider that I'm the attacker and have access to hashes of passwords of a given database against which I will attempt a dictionary attack. My question is: Will I be able to find out by ...
3
votes
0answers
69 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
2
votes
1answer
590 views

How to dynamically generate the hash value of a file while it gets downloaded from any website?

I've tried generating the hash value of a file that is trying to get downloaded and compared it against the list of hash values, and if there is a match then it doesn't get downloaded.Here i have ...
0
votes
1answer
61 views

Password storage which avoids privileged insider attack

What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
3
votes
1answer
183 views

Is hashing without a salt secure for random passwords? [duplicate]

I'm designing an API with token authentication. I don't want to store tokens as plain text in the database, for the same reason user passwords are not stored as plain text: if the database gets ...
2
votes
0answers
73 views

Extracted LM Hashes doesnt match actual password

I'm new to LM Hashing and Windows authentication, and I'm having problems with LM hashes. I've created 2 accounts with the password "123", and both of them have different hashes, and none of the ...
-1
votes
1answer
85 views

Can one alter SHA-1 input data without changing the hash internal state? [duplicate]

Let's say I have an input message of "enoughly long" length (I'll got for a 128 bytes long message, but it might be 256 or whatever). I know the hash sha1(message || secret) where || is byte ...
1
vote
2answers
366 views

PHP password_hash (bcrypt) vs sha-3 [duplicate]

password_hash() is the recommended function in PHP to generate password hashes. The standard usage is password_hash($password, PASSWORD_DEFAULT); and default hash with PASSWORD_DEFAULT is bcrypt. The ...
1
vote
2answers
124 views

Comparing uniquely salted hashes

I have a system which needs to compare hashed identifier values. I want to salt my hashes, to prevent them being cracked with a rainbow table. However, the system needs to be able to compare the ...
0
votes
0answers
40 views

Is there a protocol fuzzer or fuzzing framework that uses cryptography?

When reading about fuzzing, the way to go seems to ignore checksums and cryptographic integrity protection or at least circumvent verification procedures via a 'fuzz-friendly mode'. For black-box ...
-1
votes
1answer
56 views

Is this method of storing a data-field secure?

I'm trying to convert a data field to something tokenized(that's to something not-sensitive). The current scenario is, I've got a data field (assume user-id) which is unique for each user, I don't ...
0
votes
1answer
812 views

Hashcat - separator unmatched running pmkid 16800 crack

I'm working on cracking a pmkid file. I have collected pcap file using bettercap. Then convert using this: hcxpcaptool -z bettercap-wifi-handshakes.pcap.pmkid bettercap-wifi-handshakes.pcap They ...
0
votes
1answer
91 views

When encrypting password hashes, how to handle nonces?

I know that encrypting password hashes is a contentious issue. However, I have seen it recommended in some quarters. I know for instance that DropBox did this at one time with AES256. In these cases, ...
3
votes
1answer
92 views

Is there any benefit using a two-step salted hash? [closed]

Commonly when implementing authentication mechanisms that accept passwords is to add salt when hashing the password. Reading the article here: https://engineering.gosquared.com/evolution-of-password-...
1
vote
3answers
214 views

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
1
vote
1answer
92 views

Schemes for ID obfuscation like Facebook app scoped IDs

After certain privacy concerns Facebook rolled out a bunch of changes to their APIs, one being "scoping" user identifiers per app. In effect, this means that Alice's canonical facebook user ID is ...
0
votes
0answers
111 views

Is gnupg2 --refresh-keys susceptible to any attacks based on fingerprint collisions?

Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys Mallory ensures that Bob uses her keyserver, which offers her own key, which is sharing the 32-bit "short" Key ...
2
votes
1answer
76 views

What hashing algorithm does VirtualBox use for passwords in its config files?

To authenticate with RDP, VirtualBox allows to set a password using this command: VBoxManage setproperty vrdeauthlibrary "VBoxAuthSimple" VBoxManage modifyvm "VM name" --vrdeauthtype external ...
2
votes
2answers
673 views

Appending a secret (pepper) to Argon2 password hashes

I've read quite a bit of the StackExchange and HackerNews debates on the user of "peppers" in password hash security. There are a number of different implementations of the idea of a pepper, ranging ...
1
vote
3answers
171 views

Hash pepper in web application possible?

I have read a few articles and several question on here about hashing correctly. While hashing, adding salt and especially pepper is primarily a server side use case, I am interested in the ...
0
votes
0answers
324 views

bcrypt.checkpw() returning true for different salt+hash

new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
0
votes
0answers
43 views

Web app: using two hashing schemes for CPU-friendly password validation & secure storage [duplicate]

Consider a web application that: uses HTTP Basic Auth over HTTPS, and therefore needs to validate a password (an API Key) on every request and needs to handle a substantial load has very few distinct ...
13
votes
3answers
4k views

Hashing password to increase entropy

Is it secure to hash a password before using it in an application to increase password entropy? Does this practice increase entropy when a PBKDF is used in the application itself or does the PBKDF ...
0
votes
1answer
105 views

Can't detect hash type even if I have the password?

I can't found the hash type used in a database hosted in a VM. My hash is c39e02416d974229752c28d7fcefe6e1, and my password is "azerty123456". I noticed that the user table has a column called ...
0
votes
2answers
172 views

Can an attacker modify data so that the hashing technique cannot detect the change?

I'm just curious as to if this is possible or not?
3
votes
1answer
165 views

Is there a security difference between GPG signing a file directly or its SHA512SUM file?

I am about to decide what SHA-512 hash sum and / or GPG verification scheme I will choose. Let me present you with two options: Signing the 25 GB ~ 23 GiB (one file fit to a Blu-Ray) directly with: ...
0
votes
2answers
428 views

How long does it take to compute hashes using the MD5 hash algorithm? [closed]

1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds? 2) Will salted and unsalted versions of md5 hash algorithms take approximately the same ...
-1
votes
1answer
1k views

hashcat - cracking a salted sha256

Given a SHA512 hash, a salt, and username I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline without ...
14
votes
2answers
2k views

What are SHA-rounds?

I understand more sha-rounds make it difficult to bruteforce the hashed password in /etc/shadow. Higher rounds also use more CPU processing when executing sudo commands and logging into the Unix ...
0
votes
0answers
110 views

Does the password goes weaker as they get longer since hash has a fixed length? [duplicate]

For example, sha256 has a fixed hash length of 64 characters. So I'm wondering will a password goes weaker as they get longer and longer? Since no matter how long your password goes, the sum will be ...
0
votes
1answer
121 views

MD5 Checksum and DLL injection

I would like to know if it is possible that a file checksum or MD5 Checksum is an option for identifying malicious embedded code. As an example, I have a development environment and I want to prevent ...
0
votes
1answer
289 views

Is this method of hashing passwords good? Node.js [duplicate]

I am currently developing a login for my website, (using node.js and MySQL) and would like some feedback on the password hashing code. const crypto = require('crypto'); function RandomSaltString(...
-1
votes
1answer
102 views

Best tool for cracking SHA-1s with unique pre and post salts? [closed]

I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
0
votes
0answers
25 views

Does limiting the length of a password help prevent DoS attacks? [duplicate]

I was told that you can DoS a server with unlimited password length because of the time that it would take to hash it. But isn't the password hashed on the client's side before leaving the user's ...
1
vote
2answers
131 views

Is storing the bcrypt salt in isolated database a good idea?

I read many answers on the stackexchange about Bcrypt, Salt and Where exactly to place the salt. For hashes such as BCrypt it is trivial to extract salt from the hash. So, It doesn't matter really ...
-4
votes
1answer
120 views

If I hash a password 40 times, will it be breach proof? [duplicate]

Let's say I have a password like: password123 If I was to hash it 30 times, will it be (nearly) breach proof? I have a loop which goes through all the hashing algorithms and hashes them continuously. ...
2
votes
2answers
552 views

HMAC and key size

I generated a keyed hash using HMAC-MD5 and HMAC-SHA256 for an arbitrary file with various keys of different lengths. Do we have to use a key with a fixed size in HMAC? If so, what is the key size? ...
0
votes
0answers
34 views

Does a small max password length indicate there might be a security issue? [duplicate]

Some websites state specific requirements for a password when you create an account. Some are understandable, but in particular the maximum password length doesn't make sense to me. Some websites ...
4
votes
6answers
959 views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
9
votes
2answers
1k views

Is there a loss of entropy by hashing an N-bit random key to produce an N-bit hash?

I read the following piece of code: dd if=/dev/urandom bs=16 count=1 2>/dev/null | md5sum Apparently, this code was used as a trick to produce a hex string key from a 128-bit binary pseudo-random ...
0
votes
0answers
36 views

Where do salts come from? [duplicate]

A salt can be a random value and length. The hash and the salt are stored in the database. Is there a separate salt generator function used? Is it just a random generator? Does it need to be a ...
6
votes
3answers
232 views

What are the 'P' values in some cipher string?

Most of the cipher strings I see are in the format: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ...
0
votes
1answer
37 views

Generate DEK from password using hashing on client-side

Important to know Will not be passing the DEK from client to the server The DEK will be used to encrypt all the data being placed within a github repository, it is possible that cipher-text will be ...