Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
3
votes
3answers
156 views

Is it possible to use “cryptographic hash function” for “digital signature”?

I understand that a cryptographic hash function is a function that generates a fixed size random string for an arbitrary input. However, is it possible to use a cryptographic hash function for ...
0
votes
0answers
314 views

How to mask attack a sha256 hash with following information using hashcat?

I am hashcat newbie and I want to crack a hash :) The answer is 1-15 (unknown) characters and it may contain 'a-z' 'A-Z' '0-9' and '_' . (A Twitter username) How may I mask attack a hash with above ...
1
vote
2answers
558 views

Does a File's Checksum Change after it is Digitally Signed?

From my understanding, when you digitally sign a file, it changes that file's checksum because they are bundled together. Example of what I mean: file1.txt only contains the letter 'd' and the ...
1
vote
1answer
94 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
2
votes
4answers
380 views

Why should we protect access to password hashes?

Why should we protect the access to the password hashes? And under what conditions can this precaution be omitted?
1
vote
0answers
44 views

Increase password iterations?

Is it possible to strengthen the macOS login password by increasing the number of sha-512 iterations?
1
vote
1answer
61 views

Ensuring key integrity

I have encrypted AES key stored in the database with the encrypted data. AES key is encrypted with a key derived from the passphrase. I want to ensure the integrity of the stored AES key. Is the ...
1
vote
1answer
169 views

How do Field Programmable Gate Arrays (FPGAs) compare to Graphics Processing Units (GPUs); for cracking hashes?

As a general rule, GPUs are more effective than CPUs when it comes to performing acutely repetitive tasks, like iterating over lists and generating permutations of a set (i.e. exhausting dictionaries &...
2
votes
1answer
56 views

Proof of information having been created before it is released

I have been thinking about the following use-case: some institution wants to organize bets about an outcome that is of its own choosing. The timeline is as follows: The organization chooses the ...
0
votes
1answer
273 views

Both Ophcrack and ONTP&RE incorrectly show Windows 10 passwords as blank

I'm trying to crack a Windows 10 laptop that I myself set a password on a day or so ago. So far I've tried booting into Ophcrack 3.6 and ONTP&RE (Offline NT Password & Registry Editor) from ...
5
votes
2answers
3k views

Why is SHA-256 not good for passwords? [duplicate]

I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 ...
2
votes
1answer
238 views

How to programatically verify a file signature?

I have a dll file signed with my private key, here is the signature info in Windows Explorer: Now, using the public key found in the certificate, how can I verify the integrity of the file? I am ...
0
votes
1answer
213 views

Does hashing a file consider its digital signature as well?

I have a signed (using Windows signtool) executable which is hashed by SHA1 algorithm and encrypted using RSA. Now I like to verify the executable to avoid security vulnerabilities. For that I have an ...
50
votes
3answers
6k views

What is the benefit of having a cryptographically secure hash algorithm in hashmaps?

I recently read the Rust language documentation and saw this: By default, HashMap uses a cryptographically secure hashing function that can provide resistance to Denial of Service (DoS) attacks. ...
1
vote
1answer
162 views

If someone has a hashed password, how long till they decrypt it?

Earlier my friend suggested that we have a race to see who could decrypt a hashed password first. I want to do it but I don't want it to be an all month thing. I know when passwords are hashed they ...
2
votes
4answers
785 views

Do different files always have different MD5 or SHA1 hash codes?

My question is if different files always lead to different MD5 or SHA1 hash codes?
0
votes
1answer
62 views

Is any plaintext stored as a password hash an effective way to lock out an account?

I'm building a web app with Flask and I have user accounts that store their passwords in a MySQL String column using werkzeug.security's generate_password_hash() method. I wanted to create a Community ...
2
votes
2answers
109 views

To build a rainbow table, how to decide size of chain and number of lines?

To be sure I well understood the Rainbow Tables, I've decided to make a little project in Java, but I"m stuck on a question : how to choose the size of the chain ? And this will give the number of ...
6
votes
4answers
6k views

Checksum vs. Hash: Differences and Similarities?

What are similarities and differences between a "checksum" algorithm and a "hash" function? Can they be used instead of each other? Or their usage are different? For example, for verifying the ...
0
votes
1answer
279 views

Same content different hash? [closed]

So I made a txt file using notepad and made a hash of it: SHA1: 701B6FAD6530C61528F9C11F024A9434B3C42D65 then I edited that file and took the hash again: SHA1: ...
3
votes
2answers
582 views

John the Riper couldn't crack all the passwoords

I have a password file with 7 passwords, but JTR only could crack 4 and 3 that couldn't. What it's the reason? C:\tmp\john179j5\run>john --show shadow.txt root:password:12923:0:99999:7::: student1:...
0
votes
1answer
127 views

Is AES + MAC more secure than encrypting plaintext along with its hash

Suppose I want to encrypt some plaintext and I can only use an unauthenticated AES mode like CBC. One way of adding authentication is encrypt-then-MAC, where the two different keys for AES and MAC ...
2
votes
1answer
118 views

Slow Hashing Without a Salt?

I'm trying to design a security scheme that involves a shared secret but isn't a traditional account password situation. The server would store a set of "keys", each of which has a blob of data ...
0
votes
1answer
373 views

Using AES encryption to generate MAC (and provide authentication/integrity)

Ignoring that there are far better and more standard approaches to providing authentication and integrity guarantees, what (if any) weaknesses would a system as outlined below that relies on AES (AES/...
2
votes
1answer
53 views

Securely Download lubuntu from Non-Ubuntu System

The recommended way to find out which public key you need to verify the Ubuntu hashes is to attempt to check a signature of the hash file (both of which were downloaded in the clear). This produces an ...
0
votes
1answer
37 views

How can hash keys of downloadable binaries be useful if a website has been compromised? [duplicate]

Sometimes a website that has some binaries to download, also presents their hash keys, so that a user can verify the integrity of the binary. I suppose this is mainly for security reasons, not to ...
1
vote
2answers
65 views

Confusion about the software and also the digital signature getting modified

I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted ...
1
vote
1answer
267 views

Best practices to protect public/private SSH key pair in web interface?

I've got a dilemma here: I'm working on a system that will connect to remote linux servers for monitoring and automating some processes. Since user+pass is insecure for obvious reasons and public/...
7
votes
2answers
1k views

What could an attacker do if they gained access to PBKDF2 hashes?

This is regarding a web application where a user has to login with their personal email as the ID, and a password they have chosen personally. If an attacker somehow gained access to a credential ...
42
votes
1answer
15k views

In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?

There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
1
vote
1answer
157 views

How to increase the time for an offline password attack

I am trying to answer a CASP exam practice question. Could someone comment on the options below regarding the logic behind each item? Where is the logical error behind each statement? A Storage-...
0
votes
2answers
2k views

Is it possible to crack Joomla hash password?

I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash Joomla password which is (5aa154999c111bf7f33a1a3cadba5847) and I don't know the salt. is there any way to crack ...
0
votes
2answers
367 views

Generating multi-word passphrases from a wordlist

As part of pentesting NT hashes where the underlying passwords are minimum 16 characters of length, I have created a wordlist of common words, sports teams, movies, names, years etc. - inspired by the ...
1
vote
2answers
166 views

Is RIPv2 MD5 authentication insecure?

While performing a vulnerability assessment, I stumbled upon RIPv1 poisoning routing table attacks. The recommendation is to use RIPv2 with MD5 authentication. The idea is that the routes need to be ...
1
vote
1answer
688 views

hashcat specific brute force

Is this scenario possible: I know the first three letters of the password (exact), i know the password is between 10-14 characters, i know the rest of the characters are "b,t,p,1,3,6,7" which can be ...
0
votes
2answers
8k views

Most efficient way to crack a NTLM hash

I've been given a non-salted NTLM hash and a week worth of time to find the password it hides. I have also been told the password length is 11 chars, and that it is a Windows 10 user password. I'm ...
0
votes
1answer
154 views

How to save one password for all users without hashing?

I am working on a plugin for site A that logs in to an external site B. The plugin needs to store the password to site B, but I can't use hashing because I need to send the login information to B. I ...
0
votes
1answer
209 views

Implementation of PMKID computing function

I am trying to implement a function, let's say in Python to compute Pairwise Master Key Identifier (PMKID) after reading the previously discovered bug in WPA2. Googling gave me this logical statement: ...
1
vote
1answer
215 views

Javascript asymmetric password-based encryption

I want to code a web app that allows 2 users to send encrypted messages to each other, and I want to maximize security, so I want to minimize the amount of trust I put in my cloud provider (both the ...
1
vote
1answer
595 views

Understanding ANSI/AAMVA encoded data (pdf417 data matrix) on back of NYS ID card

Background I am developing an Android application for work which runs on a Zebra TC51 bar code scanner, which I have been playing around with.. I scanned my NYS drivers license and inspected the ...
0
votes
1answer
215 views

When would one use a password hash instead of a KDF?

From what I'm reading, for storing passwords it is recommended to use a KDF (like Bcrypt). If it is more secure to use a KDF for handling passwords, when would you use a password hash instead?
1
vote
2answers
92 views

Why would a phishing blacklist be hashed?

I was planning to comment on the question at Finding phishing sites to certain domain and suggest searching Google's blacklist for keywords or substrings of a domain name in question. But then I ...
7
votes
5answers
307 views

Do hashes contain any of the original file’s data?

I am not a computer scientist, but would like to understand hashes such as SHA-256 more. Am I right in believing that a hash is simply a statement that a file produced a specific output (the hash), ...
0
votes
1answer
73 views

Crack Hashed Byte Array? [closed]

I know it would take forever to crack a simple hashed byte array, though for learning sake I was wondering whether it is possible to crack a hashed byte array? And if so, any suggestions how to do ...
0
votes
2answers
196 views

Can I throw away a private key and use the public key like a hash function?

Yes yes I know "don't invent your own protocols unless you're an expert". No need to yell at me I just want to know if there's a flaw in this idea and if not has anyone done it before. The motivation ...
1
vote
1answer
537 views

Hash a secret API key with a random salt instead of sending sending it alone in REST API

Say, I have an internal https API endpoint used only by me being the admin. In each each request I send a secret API key for authentication. And I'm fine with this solution. curl -x PUT ....... -...
2
votes
4answers
478 views

How to ensure file integrity cryptographically?

Problem: I have a collection of files (source code for example) whose integrity has to be ensured. I don’t care if the files are corrupted (I can easily multiple backups). I just want to make sure ...
0
votes
1answer
121 views

Proper way to verify keycard integrity

I have thought about building an electronic door locking system. Would the following mechanism be secure at all to prevent tampering plain text information on card? hash private system key together ...
2
votes
3answers
5k views

Is it possible to crack any SHA1 hashed password

I'm trying to understand how easy it is to crack a SHA1 hashed password. I have a training database giving hundreds of password hashed. I have tried to use some online tools to crack them and I have ...
1
vote
0answers
93 views

How do I examine a fresh Windows 10 installation

I suspect an unauthorized modification has been applied to a fresh new installation of Win 10 x64 and/or a PC running it by a person who knows me personally with the purpose of tracking my activity ...