Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
10 votes
4 answers
3k views

Password management of emailed cleartext passwords

If a website emails a password in cleartext when you use the "forgot password" function, is there any possibility that the password is hashed? It does generate a different password if you ...
user avatar
  • 103
0 votes
2 answers
137 views

Could blockchain be useful for a protocol to verify content from a trusted publisher in the way I'm thinking of? [closed]

The problem with static software whitelisting is that in the real world, employees with versatile jobs need to run unexpected programs. Company sets up a whitelist to limit what programs can run - ...
user avatar
  • 1,290
26 votes
3 answers
7k views

Known strings to have the same MD5 hash, not colliding in real life?

I was reading this article about MD5 hash collisions in which it clearly states that these two strings (differences marked with ^): ...
user avatar
22 votes
4 answers
8k views

Does password length / complexity make any difference if hashes are leaked?

Password length/complexity only mitigates a brute force attack, correct? In the event of a hash leak, since any algorithm is a fixed length, there could potentially be a pre-image* with a very short / ...
user avatar
  • 323
1 vote
0 answers
229 views

Using John the Ripper for Blockchain.info second password

Is there a way to use JtR for Blockchain.info's (v2) secondary password? I already tried the blockchain2john.py file, and it does not ask for primary password (which I know already) so it is going to ...
user avatar
  • 61
-3 votes
2 answers
171 views

Number of biometric samples required to form an exhaustive set of fingerprint hashes?

Number of biometric samples required to form an exhaustive set of fingerprint hashes? Slight variations in the sample produce different hash values of the sample data. The answer linked below ...
user avatar
  • 93
0 votes
2 answers
228 views

Odds of two messages sharing the same hash prefix

If only the first h bits of a certain SHA256 hash H of a certain message M are known, and one had managed to successfully guess an input message M' whereby SHA256( M' ) yielded an H' whose first h ...
user avatar
  • 111
0 votes
2 answers
113 views

Does using subkeys provide better protection in this instance?

I was thinking of implementing the following scheme for encryption of many independent files: From the password, which is given by the user, generate a master key using for example HMAC-SHA. From ...
user avatar
0 votes
0 answers
120 views

Web authentication, replay, nonce and KEK

I am trying to figure out how to build a secure, playback-proof, web authentication scheme and at the same time be able to use a KEK at the server. After a lot of reading it seems that a reasonable ...
user avatar
0 votes
1 answer
116 views

Securing data stored on a file

Suppose I have an application, which when opened asks you to open a file and then "unlock" that file using a password that's configurable by the user. The file should be encrypted with ...
user avatar
0 votes
2 answers
291 views

Is it possible to reverse a hashed password? [duplicate]

Is it possible to reverse a password hashed with bcrypt?
user avatar
  • 17
11 votes
5 answers
7k views

Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?

I was reading this article which talks about a design to shorten URLs, and in the design section, it says that the given URL can be hashed using a hashing algorithm such as MD5, and then be encoded ...
user avatar
  • 213
2 votes
1 answer
205 views

How can I use a unique salt for each user

I know there are various questions that seem similar, for instance, this one. However, it does not answer my question. I'm creating a signup/login system (with node.js to be particular), and I'm ...
user avatar
  • 23
17 votes
1 answer
6k views

How can Freeradius detect if the password provided is right when only the salted hash is stored in the database without the salt

I am discovering both Freeradius and the password hashing mechanism. I built a database (in MySQL) to store the passwords of some users. I have a user with the password in clear text, another one ...
user avatar
  • 173
0 votes
0 answers
74 views

Display a token's expiration date to a user

We use multiple kinds of token in our system for : Invitation to joint a group Account creation (validate if the user possesses the email address) Validate email address The tokens are sent in a ...
user avatar
0 votes
0 answers
134 views

FedRamp Moderate question about hashing MD5

If I use MD5 but not for cryptography purposes, and not for any authentication or authorization mechanism, Am I in violation of FedRamp Moderate?
user avatar
0 votes
2 answers
178 views

Avoiding password cracking by using custom hashing procedure?

In summary: the idea behind password cracking is just to replicate the password validation procedure of a web server locally with lots and lots of attempts and check whether the output of that ...
user avatar
2 votes
1 answer
441 views

How good/bad is this implementation to secure password?

I've just started new project and decide to try something new, so I'am not using anymore EnityFramework and Identity framework. I Decide to try MongoDB, so i wanted to design from scratch storing ...
user avatar
  • 123
1 vote
1 answer
198 views

Randomness of hash of (password + suffix)

Suppose I have a password, say "thisIsThePassword". Then I have MD5 hashes of that password followed by an increasing numeric suffix: MD5("thisIsThePassword1") = ...
user avatar
  • 15.3k
1 vote
1 answer
102 views

Is combining salt from two places secure enough and what length

I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough - The password is hashed using PBKDF2-SHA256 (which ...
user avatar
  • 113
0 votes
0 answers
33 views

Can I truncate a hash value and keep (the expected amount) of collision resistance? [duplicate]

I'm building a URL-shortening tool. For an arbitrary link, I need to produce a fixed-length slug which will index the full URL in a database. For prettiness reasons, I'd like to keep the slug ...
user avatar
6 votes
2 answers
1k views

Since GPUs have gigabytes of memory, does Argon2id need to use gigabytes of memory as well in order to effectively thwart GPU cracking?

The common advice of benchmarking a password hashing algorithm and choosing the slowest acceptable cost factor doesn't work for algorithms with more than one parameter: adding a lot of iterations at ...
user avatar
  • 31.8k
0 votes
3 answers
222 views

How many bytes for password reset token? Should one take steps to hash or conceal raw CSPRNG bytes?

I'm trying to follow the OWASP 'Forgot Password Cheat Sheet' recommendations for password reset functionality via email. This requires my server to generate a token. OWASP says that PHP's random_bytes(...
user avatar
  • 196
0 votes
1 answer
155 views

Replace hashed password by public key generated from password

I don't like my server having access to plaintext passwords. Instead of SRP, OPAQUE or another PAKE that needs several rounds, I was thinking I could take the username, server url and password, run a ...
user avatar
-5 votes
2 answers
127 views

Is there a way to programatically generate new hash functions that are secure?

Is it possible to programmatically generate different hash functions? Of course, it is. We can simply tweak the numerical parameters of the hash function. But is there a known way to generate secure ...
user avatar
0 votes
0 answers
199 views

error john the ripper on id_rsa conversion

Why doesn't my conversion from id_rsa work? I have an empty file in the final conversion idrsa.hash and when I use command cat idrsa.hash to check the result is ERRNO2 no such file or directory : ...
user avatar
  • 1
0 votes
0 answers
64 views

Is salt even secure once hacker has access to the database? [duplicate]

I have seen so many articles which they write that the salt is stored together with the hashed password in the database. However, there's one thing that is bugging me. Since the plain text salt is ...
user avatar
  • 9
1 vote
1 answer
200 views

How NTLM SSO is preformed on smartcard Kerberos logon?

I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved. After an interactive logon with kerberos, you will have in the cached credentials both ...
user avatar
3 votes
1 answer
515 views

How does Linux know if a new password is a "wrapped" version of a old one?

How does Linux know if a new password is a "wrapped" version of an old password? (or, the process of creating a new password) know "certain" parts of one's password? Let's say I ...
user avatar
24 votes
6 answers
12k views

Is it safe to publish the hash of my passwords?

How unsafe would be to publish the hash of my passwords? I have written a Python script for helping me to remember my basic passwords (computer password, encrypted backup password, AppleID password, ...
user avatar
  • 359
5 votes
4 answers
2k views

Having a list of hashes for the same password compromise the security of the password?

An attacker want's access to a specific account, he doesn't know the password. It's a high entropy password. +128bits The attacker has the hash for the password (Assuming OWASP suggested bcrypt with ...
user avatar
2 votes
1 answer
1k views

Are bcrypt hashes safe enough if exposed?

Considering: A VERY motivated attacker, A large entropy password, as in 256bits¹ hashed in bcrypt (with recommended cost factor of 12), and Attacker knowledge of everything he might need (except the ...
user avatar
1 vote
2 answers
630 views

Is it OK to hash sensitive data, given hashes provide no confidentiality?

Confidentiality is the property of a message whereby no one but the person who knows a secret (let's calle it K) can read the message. Hashes do not provide confidentiality (data is destroyed, you can'...
user avatar
1 vote
0 answers
559 views

Dynamic format used in John the Ripper jumbo way slower than MDXFind

I'm currently doing some research on a pretty huge list of hashes (approx. 2 millions) and thus I'd like to improve my cracking speed. The hash format is 12 rounds of SHA512(password + salt), which ...
user avatar
  • 111
28 votes
4 answers
4k views

Do you rather trust a widely adopted algorithm or an underdog if they're cryptoanalytically on a level playingfield?

If it comes to the security a hashing or encryption algorithm provides, we never know the full story. There's that part that we (respectively the public research) understand and can reason about, but ...
user avatar
1 vote
1 answer
239 views

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
user avatar
0 votes
1 answer
72 views

How to sign multiple data sets with a single signature, so that it can be validated for single data set without requiring the rest of the data?

Let's say Alice has three secrets: SecretA, SecretB, SecretC Alice shows these three secrets to Bob and gets a single signature from him that signs all three secrets together. Something like Signature ...
user avatar
0 votes
4 answers
195 views

Why can't you use the same password for every site, if they are hashed on the site?

I've often heard people talking about not using the same password on every website. What's the deal if servers store passwords in a SHA hash instead of plain text? The most they can do is spam you ...
user avatar
1 vote
1 answer
354 views

dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?

I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt. I want to confirm some of my understandings: Salt is automatically generated by cyrptsetup with ...
user avatar
  • 143
2 votes
0 answers
162 views

Why does firebase encrypt with password hashes instead of storing the hashes?

I am trying to migrate off of firebase, as in doing so, you can export the hashes of user passwords. Looking at their algorithm, they do not store password hashes, but rather, they use the first 32-...
user avatar
  • 121
0 votes
1 answer
308 views

OpenSSL: how to get matching subject_hash from a CMS SignerInfo?

So OpenSSL can calculate a hash value for X509 certificates that uniquely identifies this certificate: https://www.openssl.org/docs/man1.0.2/man1/x509.html (argument -hash or -subject_hash) now, if I ...
user avatar
1 vote
1 answer
194 views

Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?

To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
user avatar
  • 115
0 votes
1 answer
128 views

Sending and blocking emails from hashed and salted address ? (for GDPR)

I would like to send emails from a server, but also make them unable to trace for me as server owner or attackers. I want this for GDPR but also to protect people from abusers. Short info about ...
user avatar
  • 3
6 votes
1 answer
2k views

For bcrypt why is JTR so much faster than hashcat?

To keep it short I've recently been learning about hashing and password hash cracking on TryHackMe. I was tasked to crack the following hash: $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V....
user avatar
1 vote
1 answer
114 views

Config file contains password hashes and signature keys

First, I am a beginner in IT security. I hope my question is not too dumb. I use a program that can show a live feed from a security camera. You can import a project file, that sets up user accounts ...
user avatar
  • 11
4 votes
2 answers
348 views

Why should I go to SHA512withRSA signature for my Android apps?

I have an Android 11 device and many of my apps and system apps use MD5withRSA or SHA1withRSA as signature algorithm by default. Why should I take my apps SHA256withRSA or SHA512withRSA? Are there any ...
user avatar
2 votes
1 answer
4k views

John The Ripper Error: No password hashes loaded when cracking a zip file in kali linux

I was practicing bruteforce attacks using John The Ripper. I want to crack a zip file. I obtained the hash and stored it in a zip file but when I attempt to crack the zip file it is giving me an error ...
user avatar
1 vote
1 answer
112 views

Why the need to hardcode passwords? [closed]

Many IOT devices and routers manufacturers hardcode plaintext default passwords in their devices. Why don't they store the hashed password instead? For what functionality do they need the plaintext ...
user avatar
  • 2,099
0 votes
2 answers
164 views

Why don't companies just tie the password to the user name?

One problem with passwords is that if they can be broken as follows: pick a random password hash it compare that hash to other known hashes This way, you have broken the password. Then if you can ...
user avatar
  • 11
1 vote
1 answer
374 views

What is the relation between "signature_algorithms" handshake extension and TLS ciphersuite

I am learning TLS handshake and find client/serve will negotiate a cihpersuite during client/server hello. Usually, the last part of a ciphersuite is a hash algorithm, like SHA256 in ECDHE-ECDSA-...
user avatar
  • 115

1 2
3
4 5
44