Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0 votes
3 answers
188 views

How to verify integrity of software when the download provider doesn't publish hashes?

I noticed that certain software does not provide hash anymore nowadays. E.g. Zoom https://zoom.us/download wolf@linux:~$ ls -lh zoom_amd64.deb -rw-rw-r-- 1 wolf wolf 44M Jan 1 00:00 zoom_amd64....
user avatar
  • 347
0 votes
1 answer
280 views

How password_hash / password_verify can work with any arguments (PHP)

I already know how to use password_verify and password_hash functions, but I don't really understand how they work. When I use them I do something like that: $save_hash = password_hash( $password, ...
user avatar
  • 3
0 votes
1 answer
135 views

How to identify this hashed text and if it encrypted using a key? [duplicate]

I have 2 hashes which I don't remember which type of encryption I used or if i used a secret key. can you help me identify these I will just give all details but not paste the whole hash here. hash1 ...
user avatar
1 vote
0 answers
32 views

How to assess security of Argon2 parameters [duplicate]

I would like to hash user password with Argon2id, then use this hash as ECDSA private key. I made some tests with Python and passlib.hash and found following parameters: memory: 32 MB iterations: 100 ...
user avatar
2 votes
1 answer
143 views

one-way hash with PhP onto MySQL database (NOT for password)

My users (researchers) will be storing where their website is on a mysql database on my server. Ideally I want to hash the locations so that when the researchers' participants submit their data to my ...
user avatar
  • 133
2 votes
1 answer
155 views

Why there is nothing that automatically checks signatures of files downloaded in browsers? [duplicate]

When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data ...
user avatar
10 votes
4 answers
3k views

Alternatives for sending plaintext password while login

Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
user avatar
  • 941
2 votes
1 answer
175 views

how message authentication code share keys?

How are secret keys shared between receiver and sender, especially when we want to have confidentiality that sender and receiver are using two keys, one for MAC algorithm and one for encryption and ...
user avatar
0 votes
2 answers
281 views

Private key Proof of Ownership [closed]

Given 2 entities, A and B: A has a public key( x ) and a private key( x* ). B has a A's public key hash( let's call it h(x) ). A has to prove ownership of x* to B. How could this be achieved, ...
user avatar
1 vote
1 answer
180 views

Is md5(data + key) secure if a proper hmac function isn't available?

I need to generate a MAC signature for data on a website, but it's in a HTML templating system where there's only a few functions available. The only hashing function available is md5. Ideally, I'd ...
user avatar
1 vote
1 answer
105 views

What do algorithms `128000` and `256000` do in `sha3sum`?

I wanted to try new sha3sum so I installed libdigest-sha3-perl on Debian 10. After reading man page I quickly realized that: sha3sum --algorithm 256 test.txt produces similar output to sha256sum and ...
user avatar
0 votes
0 answers
71 views

Time it will take to crack a password file? [duplicate]

I'm trying to answer a multiple-choice question which is the following: "Consider the security of a password file, which includes a 10 bit salt and all passwords are hashed, but known to consist ...
user avatar
3 votes
2 answers
154 views

Appropriate length and slow, unsalted cryptographic hash function for random codes?

Given the following situation: we have sensitive information and want to give a user access to it. At this point the user might not have interacted with our system yet. We generate a random code that ...
user avatar
1 vote
0 answers
104 views

Good use of libsodium?

I am looking to hash user passwords to store in a database that will likely reside on a user's intranet, so I am expecting the database to be classed as open and insecure. I am using libsodium 1.0.18 ...
user avatar
  • 111
0 votes
0 answers
103 views

Running Responder outputs many hashes per user, how is this possible?

I am running Responder on Kali Linux within a client network using the following command sudo responder -I eth0 -w -r -d which is capturing many hashes in the environment. Responder is a LLMNR, NBT-...
user avatar
  • 865
1 vote
1 answer
132 views

How to confirm the last entry of a linked hash list

We use a linked hash list for data integrity. Content is hashed (HMAC-SHA256) and stored in a block that itself is hashed and referenced in the next block: Simplified example: ... { id: "...
user avatar
  • 111
7 votes
1 answer
1k views

Is MD5 hashing possible by divide and conquer algorithm

I would like to compute the MD5 hash of a file The file is uploaded to my webserver by my clients The file is uploaded in pieces (called chunks) The client also sends the md5 hash of the file so that ...
user avatar
1 vote
2 answers
191 views

Enpoint protection: How to search an organisation for hash value

As part of incident response to malicious code outbreak and given the hash value of the malicious artifact, I would like to search across the entire organization for this specific hash value. Do you ...
user avatar
0 votes
1 answer
179 views

Generating tokens via PRNG and Hashing

We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it Step 1: Generate a random number using a good a CSPRNG ...
user avatar
1 vote
0 answers
80 views

Hashing of password in banking mobile app

Do I have to hash passwords on the client side of a banking mobile app since i am using a SSL network to send the password to the server end for hashing. Can the password be intercepted before ...
user avatar
  • 11
2 votes
1 answer
135 views

Can a truncated crypto hash of a truncated crypto hash help harden a resource against attacks?

In a project of mine, I have two fields which I need to use for storing a cryptographic signature (hash) of a file, but I can only use 112 bits in total, spread as 16+12 hex chars in those two fields. ...
user avatar
  • 21
0 votes
1 answer
102 views

Is client-side hashing secure during password creation when verification is still done server-side?

Trying to do this to distribute the work of creating a lot of users in which their passwords are hashed. This will cause the server to do a very large amount of work. The idea is this: (Assume ...
user avatar
0 votes
1 answer
367 views

How is the bcrypt algorithm decrypted? [duplicate]

I have a ton of hashed texts and their decrypted or de-hashed forms (I don't know which term is suitable in this case) via bcrypt. The thing I want to learn is how they are decrypted. For example, the ...
user avatar
  • 1
0 votes
1 answer
375 views

How does john the ripper crack ssh private key passphrases?

How does John The Ripper work when trying to crack passphrase of a private ssh key? What steps are involved when it tries to do so? What's the role of ssh2john in the whole process?
user avatar
3 votes
1 answer
127 views

Fail to understand how hash length extension might work in real application

I'm trying to understand how the hash length extension might work on real web applications using a hash for MAC. Especially what I don't get is, how the application considers the evil forged hash ...
user avatar
0 votes
0 answers
859 views

crack MySQL323 hash

I'm trying to crack a MySQL323 hash and I'm unable to get it done. I was able to confirm tye hash type: I came across https://www.tobtu.com/mysql323.php. I can run it as "mysql323 32.exe" [...
user avatar
  • 1,498
21 votes
3 answers
4k views

Does complexity of salt in password hashing matter?

I have no cyber security knowledge whatsoever, and am trying to safely store passwords in a database. I understood I need to use salt, to avoid rainbow table attacks and to make sure two users with ...
user avatar
0 votes
0 answers
22 views

Found out that a paid VPN service emails plaintext passwords [duplicate]

I recently found out that a VPN service does not hash their customer passwords and I need professional insight on how to deal with this. Here's how I found out: Bought a subscription on the wrong ...
user avatar
0 votes
0 answers
147 views

What is the point of hashing an API key?

Within my API backend i have a unique KeySalt for every API Key public string Key { get; set; } public byte[] KeySalt { get; set; } public string KeyHash { get; set; } When the user creates a new ...
user avatar
1 vote
2 answers
388 views

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here, the hashsum are made part ...
user avatar
3 votes
2 answers
305 views

Is using PBKDF2 good protection against brute-force attacks on web application login pages?

We've recently had a penetration test for one of our applications. The Penetration Testing company identified that our application lacks protections against brute-force attacks on the login page. Ref: ...
user avatar
0 votes
0 answers
216 views

Is caching the credentials hash and auth result secure?

I have an API that is handling a lot of volume and is using Basic authorization. This is causing me some performance issues and I'd like to move to token based auth but for various reasons, including ...
user avatar
2 votes
1 answer
190 views

Password salting vs. length extension attacks

I read that when salting passwords, it is advised to use a h(pwd||salt) construction instead of h(salt||pwd), the latter being vulnerable to a length extension attack. What are possible scenarios in ...
user avatar
-3 votes
2 answers
285 views

When will hashing no longer be useable? [closed]

I'm curious about hashing, because normal hashing is static, it means that a string that gets hashed will always be the same (except for using salt). Because of that situation, there are many websites ...
user avatar
0 votes
1 answer
1k views

What is the plaintext password of 'hash part 1' in the shadow file?

on immersivelabs lab Password Hashes II https://dca.immersivelabs.online/labs/password-hashes-ii/ there is a question: What is the plaintext password of 'hash part 1' in the shadow file? shadow.txt ...
user avatar
0 votes
1 answer
195 views

Is this Wikipedia article about SCRAM wrong?

At my Company, we put a honeypot in our network and it raised us the Lansweeper SSH password used to connect to the scanned assets (and it is reusable over many boxes...). So it is a way for an ...
user avatar
  • 1,336
22 votes
3 answers
6k views

What's a "safe" URL shortening algorithm?

The situation: Currently, we are sending out emails and SMS to our users, which include a link to a form that each user has to fill out on a regular basis (an "eDiary"). As we need to be ...
user avatar
  • 347
14 votes
7 answers
4k views

Timing attacks in password hash comparisons

I had a discussion with a friend today about his password hash comparison. I argued that you can't return false on the first hash mismatch you have and I sent him a link to an article about a Java ...
user avatar
  • 141
2 votes
3 answers
207 views

Cryptographically prove open sourced source code of server

I want to prove that the source code I am using is the same as the open-sourced version, which is publicly available. My idea was to publish a hash of the open-sourced version and compare it to the ...
user avatar
1 vote
2 answers
228 views

Encrypting a password with its own hash

I just found out that an e-commerce platform (similar to Shopify) I was planning on using allows me to see my password. I know I can't assume anything and I should (probably) just run away from it, ...
user avatar
0 votes
1 answer
150 views

Main Reasons for GPG over hashing for verification

I have recently been introduced to GPG signing as a better way of verifying data than hashing. It was described that if you posted the hash of the file, someone could hack your website, alter the hash ...
user avatar
0 votes
0 answers
213 views

how to document and check apt inrelease files? are there blockchain records for that?

apt InRelease files update like twice every day, in ubuntu repositories and their mirrors. similarly in ubuntu and debian based distros, and other apt repositories. these files are small text files ...
user avatar
  • 99
9 votes
2 answers
3k views

Should http basic auth passwords be stored hashed serverside?

HTTP basic auth sends credentials un-hashed and unencrypted over the wire, relying on TLS for confidentiality in transit. However, should the password be stored hashed using a standard KDF in the ...
user avatar
  • 412
0 votes
2 answers
165 views

Is adding encryption before hashing more secure?

One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value. Does encrypting the password || salt then ...
user avatar
  • 137
49 votes
2 answers
12k views

Magic hash attack in JavaScript

In PHP a magic hash attack happens when loose type comparisons cause completely different values to be evaluated as equal, causing a password "match" without actually knowing the password. ...
user avatar
0 votes
1 answer
87 views

Locking accounts using the same strong hash in the database

A website has some bruteforce prevention for logins, and I need to turn that off because it's buggy and it's causing problems. It will stay turned off, probably forever, because there are no plans to ...
user avatar
  • 15.3k
0 votes
1 answer
249 views

Modifying a SHA256 system to be ASIC resistant

I am looking for a way to protect a system utilizing SHA256 on semi-weak passwords against brute force attacks using ASIC-levels of hash-power, ideally by designing a system that is ASIC resistant. ...
user avatar
2 votes
1 answer
183 views

How likely is to have a hash function output flip a bit?

I was looking into this code base (https://github.com/vstoykovbg/doubleslow) and the following phrase caught my attention: DANGER of catastrophic data loss! One bit flip (due to cosmic rays for ...
user avatar
1 vote
1 answer
208 views

Avoid strong password hashing functions aiding a DDoS attempt on oneself [duplicate]

While reading this question, it got me to thinking. Let's say an attacker has some way to make all of their login attempts appear legitimate - enough IP addresses to never reuse them, different valid ...
user avatar
0 votes
2 answers
232 views

What can you do to make a hashed token database retrievable at a later date?

I have a table for single use tokens, and one of the columns is a token_digest which contains a bcrypt hash of the access token. Since the token_digest is a salted and hashed version of the plaintext ...
user avatar

1 2 3
4
5
44