Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [sha]

Secure Hash Algorithm is a family of cryptographic hash functions published by NIST. This includes SHA-1, and the SHA-2 and SHA-3 families of functions. SHA-1 is deprecated for all usages.

Filter by
Sorted by
Tagged with
0 votes
1 answer
50 views

Question about storing salt values and hashed passwords in the database [duplicate]

So I was reading through an article about how passwords are salted and hashed through a cryptographic function here, and found out that hashed passwords, along with the plaintext salt values are ...
mantot123's user avatar
0 votes
1 answer
236 views

is access token using SHA256 secure?

I want to create a server where after the user logs the server gives them a randomly generated access token that is hashed using SHA256, that I store in the database a long with an expiration date, I ...
a_duck's user avatar
  • 1
8 votes
3 answers
3k views

.exe with Digital Signature, showing SHA1 but the Certificate is SHA384, is it secure?

For this file it shows SHA1: But going into details the certificate looks like this: I know SHA1 is an outdated algorithm but I'm not sure about this nested construction. Is this insecure? Which of ...
Strah Behry's user avatar
15 votes
6 answers
8k views

Is it possible to generate a file with a given sha256sum checksum?

Is it possible to generate a file with a given sha256sum checksum? That is, reverse the process of a sha256sum checksum. That is, if we have a checksum, can we generate txt file data (need not be ...
Amruth A's user avatar
  • 223
5 votes
3 answers
578 views

Using Proof of Work to slow down login attempts

For a while I've been pondering a user authentication protocol that aims to ensure that a client does some computational work before the server will attempt to authenticate the password. The reason ...
Cruncher's user avatar
  • 153
0 votes
1 answer
546 views

Mapping arbitrary strings to hashes of 10 character length - time to crack it and collision probability [duplicate]

I would like to map strings of arbitrary length to hashes of 10 character length. The length of the alphabet is of 64 characters (0-9, A-Z, a-z, _, -). Obviously 2 same strings must produce the same ...
zer0uno's user avatar
  • 103
33 votes
1 answer
5k views

Crashing the sha1() function in PHP?

I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here. Here is my methodology: Reset the ...
user5623335's user avatar
4 votes
1 answer
1k views

What is the math behind iterations in PBKDF2-SHA256 for lastpass users?

I am looking for a technical estimate of how bad the situation is regarding the recent hack of lastpass. The hack was covered by several outlets: Naked Security, Ars Technica. Lastpass has admitted ...
Sakib Arifin's user avatar
1 vote
1 answer
118 views

Javascript: How to check SHA of fetched script before executing

To save money and/or reduce system complexity, I am hosting a script on a server that I don't fully trust. My trust issue might be with the server itself, or the PKI setup on it. The reason doesn't ...
personal_cloud's user avatar
15 votes
1 answer
5k views

Is it a good practice to add hard-coded salt to BCrypt passwords?

I am currently learning about cybersecurity and trying to implement it in my next web application. I have been reading some articles about hashing, specifically SHA2 and Blowfish. In this article, it ...
Josep Enric Sendra Serra's user avatar
2 votes
2 answers
276 views

FIPS 140-2 compliance implementation

I'm quite new to the security topic and encryption. Our software has to comply with FIPS 140-2. I have the following method (C#). In this case, the algorithm is AES256. What concerns me, is that we ...
Valentin Vadász's user avatar
1 vote
4 answers
583 views

Proving that a file existed at a time

How do I acquire the means to prove in the future that I had possission of a file now, without relying on the integrity of a single entity? (I believe one way of doing it would be to put the file ...
Callaeschrus's user avatar
1 vote
1 answer
2k views

HMAC SHA256 by using a static key + text as a key

Maybe it's not a good idea, but I would like to check it with you. When using HMAC SHA to hash a clear text value (string max 30 char) I need to use a key (256) but in my scenario this key is static ...
Marc Alves's user avatar
2 votes
3 answers
7k views

How can I extract salt from encoded base64 Salted SHA 256 hashed password

I have a SSHA256 hashed password. Below is the plaintext and hashed password for it. PlainText -p@ssw0rd Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
Karan Nayyar's user avatar
0 votes
0 answers
243 views

Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?

I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
user16551018's user avatar
0 votes
0 answers
869 views

Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error

So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
IT_User's user avatar
  • 212
1 vote
2 answers
2k views

How many rounds of Bcrypt to use for security equivalent to SHA256?

We regularly use 10000 iterations of SHA256 for hashing passwords. If we want to have similar security, how many rounds/work factor should we use when hashing passwords with bcrypt?
satya's user avatar
  • 141
0 votes
3 answers
495 views

Why can't we produce original text from sha1 if there is no random salt attached [duplicate]

I have bunch of cat images whose names are sha1 of website where it was posted. Here is an example: 3afec3b4765f8f0a07b78f98c07b83f013567a0a.jpg website: http://www.example.com/image.jpg If sha1 is ...
Josh's user avatar
  • 3
0 votes
1 answer
684 views

How hard is to reverse engineer a signature for a given message?

Given the following situation: User makes a request for temporary access to a video Backend responds with a json file containing timeAllowedInSeconds: 5 Backend also responds with the signature of ...
Vladislav's user avatar
  • 101
1 vote
1 answer
631 views

Is MariaDB Server obsolete for PHP and Wordpress projects?

PHP (and by extension WordPress) only supports MySQL native & sha256 password authentication. MariaDB Server only supports MySQL native & ed25519 password authentication. Since MySQL native ...
Joseph Michael's user avatar
8 votes
3 answers
4k views

Why not just use a small but unusual number of hashing rounds?

When it comes to hashing passwords, it is nowadays practice to do 100'000 or 200'000 iterations of SHA256/SHA512, or at least something in that ballpark. But my question is, why is it not safe enough ...
csstudent1418's user avatar
0 votes
1 answer
18k views

John the Ripper is unable to crack my SHA1 hashed password

John the Ripper is unable to crack my SHA1 hashed password: john --wordlist=rockyou.txt testing.txt Whenever I do this in Kali Linux, I get this response: Loaded 1 password hash (Raw-SHA1 [SHA1 256/...
snowyeast11's user avatar
0 votes
2 answers
636 views

Odds of two messages sharing the same hash prefix

If only the first h bits of a certain SHA256 hash H of a certain message M are known, and one had managed to successfully guess an input message M' whereby SHA256( M' ) yielded an H' whose first h ...
lhunath's user avatar
  • 111
0 votes
0 answers
42 views

Can I truncate a hash value and keep (the expected amount) of collision resistance? [duplicate]

I'm building a URL-shortening tool. For an arbitrary link, I need to produce a fixed-length slug which will index the full URL in a database. For prettiness reasons, I'd like to keep the slug ...
Daniel Littlewood's user avatar
1 vote
2 answers
224 views

Are GNU coreutils SHA digest functions FIPS-validated (in NIST's Cryptographic Module Validation Program)?

My Challenge My project has a requirement that we use only FIPS-validated modules to do anything cryptographic, including generating checksums for binaries. We've been using the SHA-2 utilities ...
Ungeheuer's user avatar
  • 113
1 vote
1 answer
1k views

Is using sensitive information to generate a UUID v5 considered secure?

Lets say I want to generate a name-based UUID using v5 of the RFC 4122 using sensitive information as the input (for example the password to my bank account). And lets say I give the generated UUID to ...
General Waters's user avatar
10 votes
4 answers
7k views

SHA & MD5 Collisions for shorter strings

This is not for passwords. I understand that MD5 and SHA-512, etc... are insecure because they can have collisions. However, is it still possible to have a collision if the string length is less than ...
Seth Knorr's user avatar
1 vote
4 answers
2k views

Certificate SHA1 Thumbprint reported as a vulnerability [closed]

So a few weeks ago I came across a security report that stated that the SHA1 thumbprint of the certificate was a vulnerability. The vulnerability was raised due to fact that the thumbprint used the ...
SecGuy45's user avatar
1 vote
1 answer
1k views

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
Jannies - They do it for free's user avatar
1 vote
1 answer
835 views

Use the public key of a certificate as the key for HMAC SHA

Consider the following scenario. A company has several computers for each users on the same domain. They purchase an RSA certificate from a recognized authority which will be deployed with private / ...
Marc Alves's user avatar
1 vote
1 answer
148 views

Need a test vector for the putty ssh-2 file mac validation

I'm trying to implement the putty file format in one of my dart packages. Implementing the actual key loading was ok, but I'm struggeling with the mac validation. I'm not shure what I'm doing wrong ...
Richard Burkhardt's user avatar
0 votes
3 answers
1k views

Different SHA256 checksum of same version of ssh binary on different machines

I was wondering if I compare SHA-256 of two binaries with same version on different machines, results will be two identical checksums. I tried this on ssh on macOS (Catalina). (I checked that ssh -V ...
John Yu's user avatar
7 votes
2 answers
4k views

How does the weakness of SHA-1 introduce attack vectors in SSH?

The security branch of my company worries that the use of older versions of OpenSSH (pre-7.4), where the only Key Exchange Algorithm available is SHA-1 is a major security issue. They suggest ...
Pepe's user avatar
  • 73
0 votes
0 answers
962 views

cracking HMAC-SHA1 when the password and seed are inverted

I happen to have a few hashes generated with code that did this (it has been changed to use a more "standard" bcrypt call): $ python3 >>> import hmac >>> hmac.new(b'The ...
mathieu's user avatar
  • 125
3 votes
4 answers
2k views

Is a SHA checksum enough to verify integrity and authenticity?

This is a broader question but here a concrete example: From apache.org: File hashes are used to check that a file has been downloaded correctly. They do not provide any guarantees as to the ...
David's user avatar
  • 143
2 votes
1 answer
1k views

why CA use private key to sign a digital certificate? What is the logic behind sign a digital certificate with CA private key?

In general(PKI), encryption happens with public key and decryption happens with private key. But, how Certificate Authority sign a digital certificate with private key? How this can be validated using ...
srikanth varma's user avatar
28 votes
4 answers
7k views

How secure is this hash-based personal password scheme? [duplicate]

I use a password scheme where I keep a small number of easy to remember personal passwords. Instead of using the passwords directly for each service, I run them through a hashing algorithm first, as a ...
bjaastad_e's user avatar
0 votes
0 answers
206 views

Risk of downgrading SHA-512 to SHA-1

I was working on a project where two programs are exchanging information over a network. I am having them generate a public/private RSA key pair to encrypt traffic. It seems that one of the ...
Bart Silverstrim's user avatar
0 votes
0 answers
203 views

Does the entire certificate chain need to be signed with the agreed upon cipher under TLS? [duplicate]

Security Newbie, I'm using OpenSSL for my client, and noticed that when testing it against Bad ssl's sha1-intermediate test, it accepts it although the agreed upon cipher is ...
david-hoze's user avatar
0 votes
1 answer
1k views

Can't solve format for Salted SHA1 hashes with Hashcat?

I am attempting to understand the format for this Salted SHA1 hash for an assignment. The line of text I was given was: [email protected],nameExample,[email protected],nameExample,,,...
WillForSchool's user avatar
-1 votes
1 answer
201 views

What type of hash is this? [closed]

Can anyone help me to find out what type of hash this is? I have it in this form: {SHA}vv359MeXQ+GgsEFZpf0No4HXxCg= But I don't think it is simply SHA1 I've tried to decode it with an sha1 ...
erjey's user avatar
  • 1
1 vote
2 answers
427 views

Hash and data modification

If I have the MD5 and SHA1 hash matches for an encrypted container. Is there no possibility it's been modified? Is it safe to assume the container has never been modified?
user223183's user avatar
7 votes
1 answer
433 views

Detect duplicates without exposing underlying data

We have a scenario where we need to prevent two users from using the same identifier. The identifier is sensitive (e.g. a social security number), so we do not want to store it in our DB. We just want ...
Peter Watts's user avatar
0 votes
1 answer
494 views

Does it increase security to hash a SHA1 hash with a common salt with SHA256 with individual salt [duplicate]

I tried to find a similar question but I did not find a question describing my exact scenario and I am still puzzled if the following actually makes an application more secure. I have legacy ...
Christoph Sonntag's user avatar
0 votes
0 answers
195 views

Web Site Access - Port Whitelisting

I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine ...
Peter Scritz's user avatar
2 votes
1 answer
180 views

Why would Chrome return non-deterministic bytes for a versioned release? [closed]

From the: Abusing SHA-1 collisions for Chromium updates https://news.ycombinator.com/item?id=20114809 https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/networking/browsers/chromium/...
niving6473's user avatar
1 vote
3 answers
397 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
das's user avatar
  • 137
1 vote
3 answers
2k views

Which function to hash 128 bit API key with?

I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
piotrek's user avatar
  • 289
2 votes
0 answers
71 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
Remy's user avatar
  • 121
1 vote
1 answer
441 views

Safe to switch from PBKDF2 to SHA-1 for token verification?

Whenever I need to generate a token (email account confirmation, password reset, remember me cookie, view email in browser etc) I generate a string of random bytes (typically 32 using the Fortuna PRNG)...
Adam's user avatar
  • 113

1
2 3 4 5
7