Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sha]

Secure Hash Algorithm is a family of cryptographic hash functions published by NIST. This includes SHA-1, and the SHA-2 and SHA-3 families of functions.

2
votes
0answers
28 views

Are the sha1 hashes used by common ssh configurations insecure?

I got an automated PCI security test result that checked various server configurations. The automated test determined the server to be unsafe due to the use of sha1 algorithm in some elements of the ...
0
votes
1answer
84 views

Iterated SHA1 hashing and the effect on rainbow table computation

Scenario: 1000 distinct keys are each prefixed with the same salt, and SHA1 hashed. The hash output is then iteratively SHA1 hashed x times. Let's start with x is 100. The specification of the keys ...
1
vote
1answer
120 views

Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)

I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
1
vote
1answer
59 views

Recover SHA1-encoded email addresses

Say you have a list of SHA1 hashes which are all encoded with the same salt. All of these are email addresses and you know at least one combination of hash and email address. Is it possible to use a ...
0
votes
1answer
180 views

SHA 1 with RSA for ssl certificate

Hi using SHA 1 with RSA encryption for ssl certificate is secure? As i know, sha 1 is not secure, but if we use RSA with sha1, still it will be an issue? Please suggest if any security issues exist.
0
votes
1answer
125 views

Same content different hash? [closed]

So I made a txt file using notepad and made a hash of it: SHA1: 701B6FAD6530C61528F9C11F024A9434B3C42D65 then I edited that file and took the hash again: SHA1: ...
1
vote
1answer
133 views

How to increase the time for an offline password attack

I am trying to answer a CASP exam practice question. Could someone comment on the options below regarding the logic behind each item? Where is the logical error behind each statement? A Storage-...
1
vote
1answer
101 views

Disabling SHA-1 in TLS handshake in Linux

As SHA-1 is not recommended, I want to disable the SHA-1 hash algorithm. I used OpenSSL API to set signature algorithm to SSL_CTX, static INT32 signAlgoList[24] = { NID_sha512, EVP_PKEY_RSA, ...
2
votes
3answers
355 views

Are mkpasswd SHA512 hashes secure for the public?

I am no crypto expert in any way so please bear with me if my question is kind of stupid. We use OpenSSH key pairs on a regular basis and due to the asymmetric nature of key pairs, as far as I ...
0
votes
1answer
170 views

Calculating Entropy using md5sum, sha256sum etc

We can calculate the Entropy S of a string simply like this: S = L * log_2(N) Where L stands for used characters in the string And N for every possible character Example: We want to calculate the ...
3
votes
1answer
291 views

Why aren’t collisions important with HMAC?

SHA-1 is broken because collisions can be found in substantially fewer hash operations than naive brute-force would suggest. HMAC-SHA1 is fine, however, because for HMAC “collisions aren’t important.” ...
4
votes
2answers
2k views

How to reverse engineer password from /etc/shadow

I failed to answer a question in a CaptureTheFlag event, and the the question still bugs me. I want to share the question here and please help me if you know the solution. Question: You have the ...
1
vote
1answer
857 views

Is SHA synonymous with SHA1 or SHA0?

There is so little info and so much confusion out there. People often equate SHA2 as being SHA256; so then would SHA be 160 bit, also known as SHA1? Is SHA deprecated, like SHA1? Are they the ...
0
votes
1answer
319 views

Conversion of user passwords from SHA-1 & encrypting plaintext data [duplicate]

I'm currently working on conversion of an old database format where user login passwords were stored as SHA-1 hashes. That same table also contains other user data that is stored in plaintext. My ...
18
votes
2answers
4k views

How secure is BCRYPT(SHA1(Password)) [duplicate]

This question is a fork from a previous question here: Is it safe/wise to store a salt in the same field as the hashed password? Assume you run a web portal, and store passwords in SHA1 hashes. How ...
1
vote
0answers
254 views

How get serial number (or SHA1 Hash) certificate without private key? [closed]

I'm trying to get a serial number ( like $ssl_client_serial in nginx ) certificate without the private key and I don't know how to do it. I have drawn a scheme: client <- HTTPS -> HAproxy or ...
1
vote
0answers
542 views

Check the signature algorithm of RDP certificate

I received a Nessus warning of RDP as following, The following certificates were part of the certificate chain sent by the remote host, but contain hashes that are considered to be weak. |-Subject ...
3
votes
2answers
709 views

Would using both SHA1 and MD5 hashes of files help reduce the risk of deleting non duplicates

I'm making a program to compare all the files on a 3Tb drive by hash and delete duplicates. I was initially going to use MD5, but was worried that with 3Tb of files, there was a slight chance of a ...
1
vote
2answers
410 views

is it secure to use sha256 to hash 64 cryptographically random byte data with 12 byte salt?

I read from a lot of sources that sha256 is not secure because it is fast. Most links that I read suggested bcrypt. However, I just want to know that if data is 64 cryptographically random byte, will ...
0
votes
0answers
545 views

OpenLDAP security SSHA [duplicate]

In OpenLDAP documentation I can find information that it supports the following encryption schemes: MD5, SMD5, SHA and SSHA. From these schemes the most secure is SSHA (SHA-1 with salt), but it still ...
1
vote
1answer
66 views

How often ciphers are used through an IPSEC session

I’m wondering how often a terminal needs to perform a cryptographic hash (ex: SHA) throughout the lifetime of an IPSEC session where both ends are authenticated using certificates. From what I can ...
2
votes
3answers
494 views

Using BCrypt to transmit sensitive data in client/server configuration

I'm developing a software in which I need to transmit sensitive data (passwords) in a server/client configuration using TCP. All data is encrypted using AES (the symmetric key is unique to each ...
0
votes
1answer
1k views

HMAC-SHA256 for JWT Token Signature

I am currently working at a company in which we have the need to design a token based authentication system. We will be the owners and controlers of two servers, one being the authentication server ...
3
votes
1answer
175 views

Are many rounds of SHA needed for a random veracrypt key

Assume that I've used white noise from the classic "zener breakdown" circuit to produce 512 bits of random data. If I use these as the key to a Veracrypt volume, is there any benefit to running 200,...
7
votes
3answers
5k views

Is it required to have the same Domain Name and Common Name for SSL Certificate?

I have an SSL cert in which CN is "abc.xyz.com". But the url shared to 3rd party organization to access a web app on our server is: "def.stu.com/what-ever". When this arrangement is working for ...
0
votes
1answer
59 views

How to check if some encryptions are disabled in OpenSSL?

I want to check if the following encryptions are disabled in the openssl-1.0.2l TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_RSA_WITH_RC4_128_SHA ...
2
votes
1answer
100 views

Can an attacker replace the hash of a download, a download, and the public key?

I have a question about DSA and GPG. Suppose you are trying to verify a downloaded file is 'legit' (i.e., no malicious code and it is the intended file). I'll just use Ubuntu's 16.04 LTS ISO image as ...
0
votes
1answer
34 views

Is it less secure to sign the semantic representation of payload then the lexical representation?

I think an example illustrates my questions best. Let's say that I want to send a JSON message. { "payload": { "b": 5, "a": 1 }, "signature": "...9oZRsvygw1pTFuRcfXXpFKMRBmkrzdTn6lzS..." } ...
0
votes
2answers
274 views

Inconsistency Among MD5, SHA1, and SHA256 Hashing Protocols

There appears to be an inconsistency (or unpublished protocol) in many online hash generators when formulating a hash from an uploaded text file, versus strictly hashing the contents of a file. This ...
1
vote
0answers
103 views

How Secure Would Client Side Sha-512 Be In JavaScript

I've created an Capture The Flag challenge for me and a few of my mates, and for the final challenge, you're goal is to log in as admin to a site. Now the site doesn't use any server side languages (...
0
votes
1answer
197 views

Is the sha1 deprecation a problem for **client** certificates?

For my web application, users connect to a web server in HTTPS and need to have a client certificate installed on their computer/browser. I understand that the sha1 deprecation is important for ...
3
votes
1answer
818 views

How find the hash creation method knowing password, salt, and resulting hash?

If I know the password, the salt (supposed salt actually) and the output hash (sha1 format). How can I find the hash creation method ? I tried basic stuff like sha1(salt+password) sha1(...
1
vote
1answer
526 views

SHA256 for IV for AES-256 CBC?

When making an IV for AES-256 CBC mode the IV should be random and shouldn't be able to be guessed. If I were to use the rand() function in C, seeded with time(NULL) to generate sim random numbers ...
0
votes
1answer
220 views

Is it safe to use SHA-512 to identify credit card?

I am thinking if using one-way function like SHA-512 is considered to be safe for application on credit card numbers. The credit card number is 13-19 number with known BIN range (6-8 numbers) and the ...
0
votes
1answer
756 views

Should I use SHA-512 with many rounds or bcrypt/scrypt

I am currently using SHA-512 with 100000 rounds because of the easier implementation. The algorithm generates passwords from a service (e.g amazon) and a master password. Would I benefit from ...
2
votes
2answers
562 views

Why are hash collisions big news?

Why is it big news to find a hash collision like https://news.ycombinator.com/item?id=13713480? I'm not asking about the implications. It seems like all you'd have to do to find a collision would be ...
4
votes
2answers
397 views

Does still make sense to use SHA1?

I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying ...
-1
votes
2answers
267 views

How can I make a program to verify file integrity? [closed]

How to make a program that calculates a checksum of a file? What is the exact process of calculating a checksum?
0
votes
1answer
335 views

Is it insecure to use PBKDF2 on a SHA1 hashed password? [duplicate]

If you already have SHA1 hashed passwords and you're trying to migrate to a better password hashing algorithm, is it less secure to just use PBKDF2 to hash the SHA1 hashes you already have instead of ...
-3
votes
1answer
226 views

Why can't hashes be reversed? [closed]

Imagine a theoretical universe where reverse hashing is possible. What if I take a 5000 bit message and hash it. So now I get a hashed string of say 256 bits. If I can get back to the 5000 bit message(...
1
vote
0answers
1k views

How to reasonably hash a composite key into a UUID?

The Problem In our system users are identified by a composite key. We'd like to devise a scheme to deterministically convert this composite key into a UUID. Solutions? The obvious first suggestion ...
0
votes
3answers
335 views

What's wrong with SHA-1 having collisions? [duplicate]

Say you go onto a website and are downloading a program. Next to the file there is a SHA-1 checksum of the file. You download the program, verify the checksum and find that it is the same as the one ...
0
votes
1answer
97 views

With the recent denouncing of SHA-1 by Google, should SHA-1 based PBDKF2 now be avoided? [duplicate]

Google recently announced "the first practical technique for generating a collision" for SHA-1. I'm currently planning a password hashing implementation for a website, and historically we have used ...
2
votes
4answers
417 views

How is knowing a specific collision of hashing algorithm useful? [duplicate]

Not too long ago the first collision of the SHA-1 was found. If I get this right, that means that someone found two different inputs that give the same output. Two different messages give the same ...
2
votes
2answers
6k views

How does this site decrypt SHA256 hashes? [duplicate]

I thought sha256 is impossible to crack (so far). But I saw a website, that could decrypt my hash. So is this because they store known hastes in a database or do they really decrypt hashes? Here's an ...
1
vote
0answers
34 views

Why Signature Hash Algo SHA-1 still uses for X509 by GeoTrust [duplicate]

Google has successfully shattered SHA-1 and still I found that SHA-1 digest algorithm is used for signing the hash. Even Google Chrome is accepting this kind of certificate without any kind of warning....
0
votes
1answer
98 views

SHA-1 deprecation and self signed internally used certificates [duplicate]

I was wondering whether SHA-1 deprecation would create any security concern for self signed (internally used) already existing certificates. What is the right thing to do in this case? Since the ...
4
votes
3answers
289 views

SHA-1 how and when is it really a problem

First, here’s my interpretation of the certificate validation process (if mistaken, please feel more than free to correct me). When connecting to a web site using https, the website present an SSL ...
4
votes
2answers
950 views

SHA1 Root Certificate Authorities [duplicate]

My understanding is that SHA1 is pretty much considered obsolete. Yet, I just opened the Trusted Root Certificate Authorities on my Windows 10 computer and I see that most Trusted Root Certificate ...
0
votes
2answers
680 views

Kali Linux SHA1 checksum changed during and after download

I was downloading Kali Linux (via direct download) and noticed that the SHA1 checksum during download was different to the official values provided. However, after the download was completed, the ...