The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [sha]

Secure Hash Algorithm is a family of cryptographic hash functions published by NIST. This includes SHA-1, and the SHA-2 and SHA-3 families of functions.

Filter by
Sorted by
Tagged with
5
votes
1answer
207 views

Detect duplicates without exposing underlying data

We have a scenario where we need to prevent two users from using the same identifier. The identifier is sensitive (e.g. a social security number), so we do not want to store it in our DB. We just want ...
0
votes
1answer
70 views

Does it increase security to hash a SHA1 hash with a common salt with SHA256 with individual salt [duplicate]

I tried to find a similar question but I did not find a question describing my exact scenario and I am still puzzled if the following actually makes an application more secure. I have legacy ...
0
votes
0answers
60 views

How long will it take to crack a hashed random string

If I generate 128 bit, 512 bit and 1024 bit random strings using either: A native rand() function (C, PHP, Python, etc) OpenSSL random bytes Hardware generated random number And hash the random ...
0
votes
0answers
52 views

Web Site Access - Port Whitelisting

I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine ...
2
votes
1answer
100 views

Why would Chrome return non-deterministic bytes for a versioned release? [closed]

From the: Abusing SHA-1 collisions for Chromium updates https://news.ycombinator.com/item?id=20114809 https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/networking/browsers/chromium/...
1
vote
3answers
206 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
1
vote
3answers
151 views

Which function to hash 128 bit API key with?

I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
3
votes
0answers
70 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
0
votes
1answer
101 views

Safe to switch from PBKDF2 to SHA-1 for token verification?

Whenever I need to generate a token (email account confirmation, password reset, remember me cookie, view email in browser etc) I generate a string of random bytes (typically 32 using the Fortuna PRNG)...
-1
votes
1answer
90 views

Can one alter SHA-1 input data without changing the hash internal state? [duplicate]

Let's say I have an input message of "enoughly long" length (I'll got for a 128 bytes long message, but it might be 256 or whatever). I know the hash sha1(message || secret) where || is byte ...
14
votes
2answers
3k views

What are SHA-rounds?

I understand more sha-rounds make it difficult to bruteforce the hashed password in /etc/shadow. Higher rounds also use more CPU processing when executing sudo commands and logging into the Unix ...
-1
votes
1answer
130 views

Best tool for cracking SHA-1s with unique pre and post salts? [closed]

I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
2
votes
1answer
610 views

SHA1 signature in a SAML request

I'm currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider. I'm not too familiar with SAML, but during the authentication, the sent SAMLRequest ...
5
votes
2answers
591 views

Are the sha1 hashes used by common ssh configurations insecure?

I got an automated PCI security test result that checked various server configurations. The automated test determined the server to be unsafe due to the use of sha1 algorithm in some elements of the ...
0
votes
1answer
194 views

Iterated SHA1 hashing and the effect on rainbow table computation

Scenario: 1000 distinct keys are each prefixed with the same salt, and SHA1 hashed. The hash output is then iteratively SHA1 hashed x times. Let's start with x is 100. The specification of the keys ...
1
vote
1answer
160 views

Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)

I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
1
vote
1answer
78 views

Recover SHA1-encoded email addresses

Say you have a list of SHA1 hashes which are all encoded with the same salt. All of these are email addresses and you know at least one combination of hash and email address. Is it possible to use a ...
0
votes
1answer
1k views

SHA 1 with RSA for ssl certificate

Hi using SHA 1 with RSA encryption for ssl certificate is secure? As i know, sha 1 is not secure, but if we use RSA with sha1, still it will be an issue? Please suggest if any security issues exist.
0
votes
1answer
406 views

Same content different hash? [closed]

So I made a txt file using notepad and made a hash of it: SHA1: 701B6FAD6530C61528F9C11F024A9434B3C42D65 then I edited that file and took the hash again: SHA1: ...
1
vote
1answer
162 views

How to increase the time for an offline password attack

I am trying to answer a CASP exam practice question. Could someone comment on the options below regarding the logic behind each item? Where is the logical error behind each statement? A Storage-...
1
vote
1answer
208 views

Disabling SHA-1 in TLS handshake in Linux

As SHA-1 is not recommended, I want to disable the SHA-1 hash algorithm. I used OpenSSL API to set signature algorithm to SSL_CTX, static INT32 signAlgoList[24] = { NID_sha512, EVP_PKEY_RSA, ...
2
votes
3answers
680 views

Are mkpasswd SHA512 hashes secure for the public?

I am no crypto expert in any way so please bear with me if my question is kind of stupid. We use OpenSSH key pairs on a regular basis and due to the asymmetric nature of key pairs, as far as I ...
0
votes
1answer
260 views

Calculating Entropy using md5sum, sha256sum etc

We can calculate the Entropy S of a string simply like this: S = L * log_2(N) Where L stands for used characters in the string And N for every possible character Example: We want to calculate the ...
5
votes
1answer
809 views

Why aren’t collisions important with HMAC?

SHA-1 is broken because collisions can be found in substantially fewer hash operations than naive brute-force would suggest. HMAC-SHA1 is fine, however, because for HMAC “collisions aren’t important.” ...
6
votes
2answers
7k views

How to reverse engineer password from /etc/shadow

I failed to answer a question in a CaptureTheFlag event, and the the question still bugs me. I want to share the question here and please help me if you know the solution. Question: You have the ...
1
vote
1answer
3k views

Is SHA synonymous with SHA1 or SHA0?

There is so little info and so much confusion out there. People often equate SHA2 as being SHA256; so then would SHA be 160 bit, also known as SHA1? Is SHA deprecated, like SHA1? Are they the ...
0
votes
1answer
424 views

Conversion of user passwords from SHA-1 & encrypting plaintext data [duplicate]

I'm currently working on conversion of an old database format where user login passwords were stored as SHA-1 hashes. That same table also contains other user data that is stored in plaintext. My ...
19
votes
2answers
6k views

How secure is BCRYPT(SHA1(Password)) [duplicate]

This question is a fork from a previous question here: Is it safe/wise to store a salt in the same field as the hashed password? Assume you run a web portal, and store passwords in SHA1 hashes. How ...
1
vote
0answers
380 views

How get serial number (or SHA1 Hash) certificate without private key? [closed]

I'm trying to get a serial number ( like $ssl_client_serial in nginx ) certificate without the private key and I don't know how to do it. I have drawn a scheme: client <- HTTPS -> HAproxy or ...
1
vote
0answers
727 views

Check the signature algorithm of RDP certificate

I received a Nessus warning of RDP as following, The following certificates were part of the certificate chain sent by the remote host, but contain hashes that are considered to be weak. |-Subject ...
3
votes
2answers
1k views

Would using both SHA1 and MD5 hashes of files help reduce the risk of deleting non duplicates

I'm making a program to compare all the files on a 3Tb drive by hash and delete duplicates. I was initially going to use MD5, but was worried that with 3Tb of files, there was a slight chance of a ...
1
vote
2answers
626 views

is it secure to use sha256 to hash 64 cryptographically random byte data with 12 byte salt?

I read from a lot of sources that sha256 is not secure because it is fast. Most links that I read suggested bcrypt. However, I just want to know that if data is 64 cryptographically random byte, will ...
0
votes
0answers
1k views

OpenLDAP security SSHA [duplicate]

In OpenLDAP documentation I can find information that it supports the following encryption schemes: MD5, SMD5, SHA and SSHA. From these schemes the most secure is SSHA (SHA-1 with salt), but it still ...
1
vote
1answer
90 views

How often ciphers are used through an IPSEC session

I’m wondering how often a terminal needs to perform a cryptographic hash (ex: SHA) throughout the lifetime of an IPSEC session where both ends are authenticated using certificates. From what I can ...
2
votes
3answers
723 views

Using BCrypt to transmit sensitive data in client/server configuration

I'm developing a software in which I need to transmit sensitive data (passwords) in a server/client configuration using TCP. All data is encrypted using AES (the symmetric key is unique to each ...
0
votes
1answer
2k views

HMAC-SHA256 for JWT Token Signature

I am currently working at a company in which we have the need to design a token based authentication system. We will be the owners and controlers of two servers, one being the authentication server ...
3
votes
1answer
222 views

Are many rounds of SHA needed for a random veracrypt key

Assume that I've used white noise from the classic "zener breakdown" circuit to produce 512 bits of random data. If I use these as the key to a Veracrypt volume, is there any benefit to running 200,...
7
votes
3answers
7k views

Is it required to have the same Domain Name and Common Name for SSL Certificate?

I have an SSL cert in which CN is "abc.xyz.com". But the url shared to 3rd party organization to access a web app on our server is: "def.stu.com/what-ever". When this arrangement is working for ...
0
votes
1answer
86 views

How to check if some encryptions are disabled in OpenSSL?

I want to check if the following encryptions are disabled in the openssl-1.0.2l TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_RSA_WITH_RC4_128_SHA ...
2
votes
1answer
193 views

Can an attacker replace the hash of a download, a download, and the public key?

I have a question about DSA and GPG. Suppose you are trying to verify a downloaded file is 'legit' (i.e., no malicious code and it is the intended file). I'll just use Ubuntu's 16.04 LTS ISO image as ...
0
votes
1answer
37 views

Is it less secure to sign the semantic representation of payload then the lexical representation?

I think an example illustrates my questions best. Let's say that I want to send a JSON message. { "payload": { "b": 5, "a": 1 }, "signature": "...9oZRsvygw1pTFuRcfXXpFKMRBmkrzdTn6lzS..." } ...
0
votes
2answers
337 views

Inconsistency Among MD5, SHA1, and SHA256 Hashing Protocols

There appears to be an inconsistency (or unpublished protocol) in many online hash generators when formulating a hash from an uploaded text file, versus strictly hashing the contents of a file. This ...
1
vote
0answers
142 views

How Secure Would Client Side Sha-512 Be In JavaScript

I've created an Capture The Flag challenge for me and a few of my mates, and for the final challenge, you're goal is to log in as admin to a site. Now the site doesn't use any server side languages (...
0
votes
1answer
261 views

Is the sha1 deprecation a problem for **client** certificates?

For my web application, users connect to a web server in HTTPS and need to have a client certificate installed on their computer/browser. I understand that the sha1 deprecation is important for ...
3
votes
1answer
950 views

How find the hash creation method knowing password, salt, and resulting hash?

If I know the password, the salt (supposed salt actually) and the output hash (sha1 format). How can I find the hash creation method ? I tried basic stuff like sha1(salt+password) sha1(...
1
vote
1answer
724 views

SHA256 for IV for AES-256 CBC?

When making an IV for AES-256 CBC mode the IV should be random and shouldn't be able to be guessed. If I were to use the rand() function in C, seeded with time(NULL) to generate sim random numbers ...
0
votes
1answer
355 views

Is it safe to use SHA-512 to identify credit card?

I am thinking if using one-way function like SHA-512 is considered to be safe for application on credit card numbers. The credit card number is 13-19 number with known BIN range (6-8 numbers) and the ...
0
votes
1answer
908 views

Should I use SHA-512 with many rounds or bcrypt/scrypt

I am currently using SHA-512 with 100000 rounds because of the easier implementation. The algorithm generates passwords from a service (e.g amazon) and a master password. Would I benefit from ...
3
votes
2answers
797 views

Why are hash collisions big news?

Why is it big news to find a hash collision like https://news.ycombinator.com/item?id=13713480? I'm not asking about the implications. It seems like all you'd have to do to find a collision would be ...
4
votes
2answers
581 views

Does still make sense to use SHA1?

I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying ...