Questions tagged [sha]

Secure Hash Algorithm is a family of cryptographic hash functions published by NIST. This includes SHA-1, and the SHA-2 and SHA-3 families of functions.

Filter by
Sorted by
Tagged with
0
votes
0answers
24 views

Can I truncate a hash value and keep (the expected amount) of collision resistance? [duplicate]

I'm building a URL-shortening tool. For an arbitrary link, I need to produce a fixed-length slug which will index the full URL in a database. For prettiness reasons, I'd like to keep the slug ...
1
vote
2answers
48 views

Are GNU coreutils SHA digest functions FIPS-validated (in NIST's Cryptographic Module Validation Program)?

My Challenge My project has a requirement that we use only FIPS-validated modules to do anything cryptographic, including generating checksums for binaries. We've been using the SHA-2 utilities ...
0
votes
1answer
75 views

Is using sensitive information to generate a UUID v5 considered secure?

Lets say I want to generate a name-based UUID using v5 of the RFC 4122 using sensitive information as the input (for example the password to my bank account). And lets say I give the generated UUID to ...
9
votes
4answers
3k views

SHA & MD5 Collisions for shorter strings

This is not for passwords. I understand that MD5 and SHA-512, etc... are insecure because they can have collisions. However, is it still possible to have a collision if the string length is less than ...
1
vote
4answers
95 views

Certificate SHA1 Thumbprint reported as a vulnerability [closed]

So a few weeks ago I came across a security report that stated that the SHA1 thumbprint of the certificate was a vulnerability. The vulnerability was raised due to fact that the thumbprint used the ...
1
vote
1answer
77 views

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
1
vote
1answer
91 views

Use the public key of a certificate as the key for HMAC SHA

Consider the following scenario. A company has several computers for each users on the same domain. They purchase an RSA certificate from a recognized authority which will be deployed with private / ...
0
votes
1answer
24 views

Need a test vector for the putty ssh-2 file mac validation

I'm trying to implement the putty file format in one of my dart packages. Implementing the actual key loading was ok, but I'm struggeling with the mac validation. I'm not shure what I'm doing wrong ...
0
votes
0answers
23 views

How to make Remmina or freerdp display matching Windows remote desktop certificate thumbprint in SHA1? Or Windows to display it in SHA256?

When using Remmina in Ubuntu connecting to Windows remote desktop, a message about a mismatch of certificates get displayed. However, Remmina is displaying it in SHA256 format. But when I look at ...
0
votes
3answers
130 views

Different SHA256 checksum of same version of ssh binary on different machines

I was wondering if I compare SHA-256 of two binaries with same version on different machines, results will be two identical checksums. I tried this on ssh on macOS (Catalina). (I checked that ssh -V ...
3
votes
2answers
250 views

How does the weakness of SHA-1 introduce attack vectors in SSH?

The security branch of my company worries that the use of older versions of OpenSSH (pre-7.4), where the only Key Exchange Algorithm available is SHA-1 is a major security issue. They suggest ...
0
votes
0answers
165 views

cracking HMAC-SHA1 when the password and seed are inverted

I happen to have a few hashes generated with code that did this (it has been changed to use a more "standard" bcrypt call): $ python3 >>> import hmac >>> hmac.new(b'The ...
3
votes
4answers
250 views

Is a SHA checksum enough to verify integrity and authenticity?

This is a broader question but here a concrete example: From apache.org: File hashes are used to check that a file has been downloaded correctly. They do not provide any guarantees as to the ...
0
votes
1answer
89 views

why CA use private key to sign a digital certificate? What is the logic behind sign a digital certificate with CA private key?

In general(PKI), encryption happens with public key and decryption happens with private key. But, how Certificate Authority sign a digital certificate with private key? How this can be validated using ...
28
votes
4answers
6k views

How secure is this hash-based personal password scheme? [duplicate]

I use a password scheme where I keep a small number of easy to remember personal passwords. Instead of using the passwords directly for each service, I run them through a hashing algorithm first, as a ...
0
votes
0answers
49 views

What is known about the strength or weakness of the PBEWITHSHA256AND128BITAES-CBC-BC algorithm?

Is PBEWITHSHA256AND128BITAES-CBC-BC known to be outdated or is it considered robust? Is it sufficient in applications that need to protect PII? Thanks.
0
votes
0answers
65 views

Risk of downgrading SHA-512 to SHA-1

I was working on a project where two programs are exchanging information over a network. I am having them generate a public/private RSA key pair to encrypt traffic. It seems that one of the ...
0
votes
0answers
57 views

Does the entire certificate chain need to be signed with the agreed upon cipher under TLS? [duplicate]

Security Newbie, I'm using OpenSSL for my client, and noticed that when testing it against Bad ssl's sha1-intermediate test, it accepts it although the agreed upon cipher is ...
0
votes
1answer
730 views

Can't solve format for Salted SHA1 hashes with Hashcat?

I am attempting to understand the format for this Salted SHA1 hash for an assignment. The line of text I was given was: nameExample@email.com,nameExample,nameExample@email.com,nameExample,,,...
-1
votes
1answer
121 views

What type of hash is this? [closed]

Can anyone help me to find out what type of hash this is? I have it in this form: {SHA}vv359MeXQ+GgsEFZpf0No4HXxCg= But I don't think it is simply SHA1 I've tried to decode it with an sha1 ...
1
vote
2answers
111 views

Hash and data modification

If I have the MD5 and SHA1 hash matches for an encrypted container. Is there no possibility it's been modified? Is it safe to assume the container has never been modified?
7
votes
1answer
237 views

Detect duplicates without exposing underlying data

We have a scenario where we need to prevent two users from using the same identifier. The identifier is sensitive (e.g. a social security number), so we do not want to store it in our DB. We just want ...
0
votes
1answer
239 views

Does it increase security to hash a SHA1 hash with a common salt with SHA256 with individual salt [duplicate]

I tried to find a similar question but I did not find a question describing my exact scenario and I am still puzzled if the following actually makes an application more secure. I have legacy ...
0
votes
0answers
299 views

How long will it take to crack a hashed random string

If I generate 128 bit, 512 bit and 1024 bit random strings using either: A native rand() function (C, PHP, Python, etc) OpenSSL random bytes Hardware generated random number And hash the random ...
0
votes
0answers
89 views

Web Site Access - Port Whitelisting

I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine ...
2
votes
1answer
109 views

Why would Chrome return non-deterministic bytes for a versioned release? [closed]

From the: Abusing SHA-1 collisions for Chromium updates https://news.ycombinator.com/item?id=20114809 https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/networking/browsers/chromium/...
1
vote
3answers
254 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
1
vote
3answers
611 views

Which function to hash 128 bit API key with?

I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
3
votes
0answers
70 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
1
vote
1answer
220 views

Safe to switch from PBKDF2 to SHA-1 for token verification?

Whenever I need to generate a token (email account confirmation, password reset, remember me cookie, view email in browser etc) I generate a string of random bytes (typically 32 using the Fortuna PRNG)...
-1
votes
1answer
159 views

Can one alter SHA-1 input data without changing the hash internal state? [duplicate]

Let's say I have an input message of "enoughly long" length (I'll got for a 128 bytes long message, but it might be 256 or whatever). I know the hash sha1(message || secret) where || is byte ...
16
votes
2answers
7k views

What are SHA-rounds?

I understand more sha-rounds make it difficult to bruteforce the hashed password in /etc/shadow. Higher rounds also use more CPU processing when executing sudo commands and logging into the Unix ...
-1
votes
1answer
345 views

Best tool for cracking SHA-1s with unique pre and post salts? [closed]

I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
2
votes
1answer
2k views

SHA1 signature in a SAML request

I'm currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider. I'm not too familiar with SAML, but during the authentication, the sent SAMLRequest ...
5
votes
2answers
2k views

Are the sha1 hashes used by common ssh configurations insecure?

I got an automated PCI security test result that checked various server configurations. The automated test determined the server to be unsafe due to the use of sha1 algorithm in some elements of the ...
0
votes
1answer
510 views

Iterated SHA1 hashing and the effect on rainbow table computation

Scenario: 1000 distinct keys are each prefixed with the same salt, and SHA1 hashed. The hash output is then iteratively SHA1 hashed x times. Let's start with x is 100. The specification of the keys ...
1
vote
1answer
226 views

Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)

I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
1
vote
1answer
119 views

Recover SHA1-encoded email addresses

Say you have a list of SHA1 hashes which are all encoded with the same salt. All of these are email addresses and you know at least one combination of hash and email address. Is it possible to use a ...
0
votes
1answer
4k views

SHA 1 with RSA for ssl certificate

Hi using SHA 1 with RSA encryption for ssl certificate is secure? As i know, sha 1 is not secure, but if we use RSA with sha1, still it will be an issue? Please suggest if any security issues exist.
1
vote
1answer
1k views

Same content different hash? [closed]

So I made a txt file using notepad and made a hash of it: SHA1: 701B6FAD6530C61528F9C11F024A9434B3C42D65 then I edited that file and took the hash again: SHA1: ...
1
vote
1answer
202 views

How to increase the time for an offline password attack

I am trying to answer a CASP exam practice question. Could someone comment on the options below regarding the logic behind each item? Where is the logical error behind each statement? A Storage-...
2
votes
1answer
466 views

Disabling SHA-1 in TLS handshake in Linux

As SHA-1 is not recommended, I want to disable the SHA-1 hash algorithm. I used OpenSSL API to set signature algorithm to SSL_CTX, static INT32 signAlgoList[24] = { NID_sha512, EVP_PKEY_RSA, ...
3
votes
3answers
1k views

Are mkpasswd SHA512 hashes secure for the public?

I am no crypto expert in any way so please bear with me if my question is kind of stupid. We use OpenSSH key pairs on a regular basis and due to the asymmetric nature of key pairs, as far as I ...
0
votes
1answer
469 views

Calculating Entropy using md5sum, sha256sum etc

We can calculate the Entropy S of a string simply like this: S = L * log_2(N) Where L stands for used characters in the string And N for every possible character Example: We want to calculate the ...
5
votes
1answer
2k views

Why aren’t collisions important with HMAC?

SHA-1 is broken because collisions can be found in substantially fewer hash operations than naive brute-force would suggest. HMAC-SHA1 is fine, however, because for HMAC “collisions aren’t important.” ...
9
votes
2answers
19k views

How to reverse engineer password from /etc/shadow

I failed to answer a question in a CaptureTheFlag event, and the the question still bugs me. I want to share the question here and please help me if you know the solution. Question: You have the ...
1
vote
1answer
5k views

Is SHA synonymous with SHA1 or SHA0?

There is so little info and so much confusion out there. People often equate SHA2 as being SHA256; so then would SHA be 160 bit, also known as SHA1? Is SHA deprecated, like SHA1? Are they the ...
0
votes
1answer
511 views

Conversion of user passwords from SHA-1 & encrypting plaintext data [duplicate]

I'm currently working on conversion of an old database format where user login passwords were stored as SHA-1 hashes. That same table also contains other user data that is stored in plaintext. My ...
19
votes
2answers
7k views

How secure is BCRYPT(SHA1(Password)) [duplicate]

This question is a fork from a previous question here: Is it safe/wise to store a salt in the same field as the hashed password? Assume you run a web portal, and store passwords in SHA1 hashes. How ...
1
vote
0answers
583 views

How get serial number (or SHA1 Hash) certificate without private key? [closed]

I'm trying to get a serial number ( like $ssl_client_serial in nginx ) certificate without the private key and I don't know how to do it. I have drawn a scheme: client <- HTTPS -> HAproxy or ...

1
2 3 4 5 6