Questions tagged [sha]

Secure Hash Algorithm is a family of cryptographic hash functions published by NIST. This includes SHA-1, and the SHA-2 and SHA-3 families of functions.

Filter by
Sorted by
Tagged with
1 vote
3 answers
163 views

Proving that a file existed at a time

How do I acquire the means to prove in the future that I had possission of a file now, without relying on the integrity of a single entity? (I believe one way of doing it would be to put the file ...
user avatar
0 votes
1 answer
90 views

HMAC SHA256 by using a static key + text as a key

Maybe it's not a good idea, but I would like to check it with you. When using HMAC SHA to hash a clear text value (string max 30 char) I need to use a key (256) but in my scenario this key is static ...
user avatar
0 votes
0 answers
72 views

Any harm in having a SHA-384 and 3072-Key for an intermediate Certificate?

I am building up a PKI and have 2 different chains of trust used for TLS Certificates. 1st Chain: SHA1-Root / 2048 RSA Key ( provided by CA ) --> SHA256-Intermediate / 2048 Key ( mine ) ----> ...
user avatar
  • 145
2 votes
3 answers
583 views

How can I extract salt from encoded base64 Salted SHA 256 hashed password

I have a SSHA256 hashed password. Below is the plaintext and hashed password for it. PlainText -p@ssw0rd Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
user avatar
0 votes
0 answers
120 views

Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?

I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
user avatar
0 votes
0 answers
132 views

Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error

So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
user avatar
  • 212
1 vote
2 answers
412 views

How many rounds of Bcrypt to use for security equivalent to SHA256?

We regularly use 10000 iterations of SHA256 for hashing passwords. If we want to have similar security, how many rounds/work factor should we use when hashing passwords with bcrypt?
user avatar
  • 141
0 votes
3 answers
172 views

Why can't we produce original text from sha1 if there is no random salt attached [duplicate]

I have bunch of cat images whose names are sha1 of website where it was posted. Here is an example: 3afec3b4765f8f0a07b78f98c07b83f013567a0a.jpg website: http://www.example.com/image.jpg If sha1 is ...
user avatar
  • 3
0 votes
1 answer
250 views

How hard is to reverse engineer a signature for a given message?

Given the following situation: User makes a request for temporary access to a video Backend responds with a json file containing timeAllowedInSeconds: 5 Backend also responds with the signature of ...
user avatar
  • 101
1 vote
1 answer
212 views

Is MariaDB Server obsolete for PHP and Wordpress projects?

PHP (and by extension WordPress) only supports MySQL native & sha256 password authentication. MariaDB Server only supports MySQL native & ed25519 password authentication. Since MySQL native ...
user avatar
7 votes
3 answers
4k views

Why not just use a small but unusual number of hashing rounds?

When it comes to hashing passwords, it is nowadays practice to do 100'000 or 200'000 iterations of SHA256/SHA512, or at least something in that ballpark. But my question is, why is it not safe enough ...
user avatar
1 vote
1 answer
5k views

John the Ripper is unable to crack my SHA1 hashed password

John the Ripper is unable to crack my SHA1 hashed password: john --wordlist=rockyou.txt testing.txt Whenever I do this in Kali Linux, I get this response: Loaded 1 password hash (Raw-SHA1 [SHA1 256/...
user avatar
0 votes
2 answers
241 views

Odds of two messages sharing the same hash prefix

If only the first h bits of a certain SHA256 hash H of a certain message M are known, and one had managed to successfully guess an input message M' whereby SHA256( M' ) yielded an H' whose first h ...
user avatar
  • 111
0 votes
0 answers
33 views

Can I truncate a hash value and keep (the expected amount) of collision resistance? [duplicate]

I'm building a URL-shortening tool. For an arbitrary link, I need to produce a fixed-length slug which will index the full URL in a database. For prettiness reasons, I'd like to keep the slug ...
user avatar
1 vote
2 answers
140 views

Are GNU coreutils SHA digest functions FIPS-validated (in NIST's Cryptographic Module Validation Program)?

My Challenge My project has a requirement that we use only FIPS-validated modules to do anything cryptographic, including generating checksums for binaries. We've been using the SHA-2 utilities ...
user avatar
  • 113
1 vote
1 answer
416 views

Is using sensitive information to generate a UUID v5 considered secure?

Lets say I want to generate a name-based UUID using v5 of the RFC 4122 using sensitive information as the input (for example the password to my bank account). And lets say I give the generated UUID to ...
user avatar
  • 113
10 votes
4 answers
5k views

SHA & MD5 Collisions for shorter strings

This is not for passwords. I understand that MD5 and SHA-512, etc... are insecure because they can have collisions. However, is it still possible to have a collision if the string length is less than ...
user avatar
1 vote
4 answers
659 views

Certificate SHA1 Thumbprint reported as a vulnerability [closed]

So a few weeks ago I came across a security report that stated that the SHA1 thumbprint of the certificate was a vulnerability. The vulnerability was raised due to fact that the thumbprint used the ...
user avatar
1 vote
1 answer
269 views

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
user avatar
1 vote
1 answer
305 views

Use the public key of a certificate as the key for HMAC SHA

Consider the following scenario. A company has several computers for each users on the same domain. They purchase an RSA certificate from a recognized authority which will be deployed with private / ...
user avatar
0 votes
1 answer
80 views

Need a test vector for the putty ssh-2 file mac validation

I'm trying to implement the putty file format in one of my dart packages. Implementing the actual key loading was ok, but I'm struggeling with the mac validation. I'm not shure what I'm doing wrong ...
user avatar
0 votes
3 answers
545 views

Different SHA256 checksum of same version of ssh binary on different machines

I was wondering if I compare SHA-256 of two binaries with same version on different machines, results will be two identical checksums. I tried this on ssh on macOS (Catalina). (I checked that ssh -V ...
user avatar
4 votes
2 answers
1k views

How does the weakness of SHA-1 introduce attack vectors in SSH?

The security branch of my company worries that the use of older versions of OpenSSH (pre-7.4), where the only Key Exchange Algorithm available is SHA-1 is a major security issue. They suggest ...
user avatar
  • 43
0 votes
0 answers
489 views

cracking HMAC-SHA1 when the password and seed are inverted

I happen to have a few hashes generated with code that did this (it has been changed to use a more "standard" bcrypt call): $ python3 >>> import hmac >>> hmac.new(b'The ...
user avatar
  • 125
3 votes
4 answers
886 views

Is a SHA checksum enough to verify integrity and authenticity?

This is a broader question but here a concrete example: From apache.org: File hashes are used to check that a file has been downloaded correctly. They do not provide any guarantees as to the ...
user avatar
  • 143
0 votes
1 answer
510 views

why CA use private key to sign a digital certificate? What is the logic behind sign a digital certificate with CA private key?

In general(PKI), encryption happens with public key and decryption happens with private key. But, how Certificate Authority sign a digital certificate with private key? How this can be validated using ...
user avatar
28 votes
4 answers
6k views

How secure is this hash-based personal password scheme? [duplicate]

I use a password scheme where I keep a small number of easy to remember personal passwords. Instead of using the passwords directly for each service, I run them through a hashing algorithm first, as a ...
user avatar
0 votes
0 answers
116 views

Risk of downgrading SHA-512 to SHA-1

I was working on a project where two programs are exchanging information over a network. I am having them generate a public/private RSA key pair to encrypt traffic. It seems that one of the ...
user avatar
0 votes
0 answers
113 views

Does the entire certificate chain need to be signed with the agreed upon cipher under TLS? [duplicate]

Security Newbie, I'm using OpenSSL for my client, and noticed that when testing it against Bad ssl's sha1-intermediate test, it accepts it although the agreed upon cipher is ...
user avatar
0 votes
1 answer
1k views

Can't solve format for Salted SHA1 hashes with Hashcat?

I am attempting to understand the format for this Salted SHA1 hash for an assignment. The line of text I was given was: nameExample@email.com,nameExample,nameExample@email.com,nameExample,,,...
user avatar
-1 votes
1 answer
164 views

What type of hash is this? [closed]

Can anyone help me to find out what type of hash this is? I have it in this form: {SHA}vv359MeXQ+GgsEFZpf0No4HXxCg= But I don't think it is simply SHA1 I've tried to decode it with an sha1 ...
user avatar
  • 1
1 vote
2 answers
287 views

Hash and data modification

If I have the MD5 and SHA1 hash matches for an encrypted container. Is there no possibility it's been modified? Is it safe to assume the container has never been modified?
user avatar
7 votes
1 answer
349 views

Detect duplicates without exposing underlying data

We have a scenario where we need to prevent two users from using the same identifier. The identifier is sensitive (e.g. a social security number), so we do not want to store it in our DB. We just want ...
user avatar
0 votes
1 answer
358 views

Does it increase security to hash a SHA1 hash with a common salt with SHA256 with individual salt [duplicate]

I tried to find a similar question but I did not find a question describing my exact scenario and I am still puzzled if the following actually makes an application more secure. I have legacy ...
user avatar
0 votes
0 answers
147 views

Web Site Access - Port Whitelisting

I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine ...
user avatar
2 votes
1 answer
152 views

Why would Chrome return non-deterministic bytes for a versioned release? [closed]

From the: Abusing SHA-1 collisions for Chromium updates https://news.ycombinator.com/item?id=20114809 https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/networking/browsers/chromium/...
user avatar
1 vote
3 answers
325 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
user avatar
  • 137
1 vote
3 answers
1k views

Which function to hash 128 bit API key with?

I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
user avatar
  • 259
3 votes
0 answers
71 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
user avatar
  • 131
1 vote
1 answer
332 views

Safe to switch from PBKDF2 to SHA-1 for token verification?

Whenever I need to generate a token (email account confirmation, password reset, remember me cookie, view email in browser etc) I generate a string of random bytes (typically 32 using the Fortuna PRNG)...
user avatar
  • 113
-1 votes
1 answer
243 views

Can one alter SHA-1 input data without changing the hash internal state? [duplicate]

Let's say I have an input message of "enoughly long" length (I'll got for a 128 bytes long message, but it might be 256 or whatever). I know the hash sha1(message || secret) where || is byte ...
user avatar
  • 1,331
17 votes
2 answers
12k views

What are SHA-rounds?

I understand more sha-rounds make it difficult to bruteforce the hashed password in /etc/shadow. Higher rounds also use more CPU processing when executing sudo commands and logging into the Unix ...
user avatar
-1 votes
1 answer
428 views

Best tool for cracking SHA-1s with unique pre and post salts? [closed]

I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
user avatar
  • 402
3 votes
1 answer
3k views

SHA1 signature in a SAML request

I'm currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider. I'm not too familiar with SAML, but during the authentication, the sent SAMLRequest ...
user avatar
4 votes
2 answers
3k views

Are the sha1 hashes used by common ssh configurations insecure?

I got an automated PCI security test result that checked various server configurations. The automated test determined the server to be unsafe due to the use of sha1 algorithm in some elements of the ...
user avatar
  • 550
0 votes
1 answer
648 views

Iterated SHA1 hashing and the effect on rainbow table computation

Scenario: 1000 distinct keys are each prefixed with the same salt, and SHA1 hashed. The hash output is then iteratively SHA1 hashed x times. Let's start with x is 100. The specification of the keys ...
user avatar
  • 103
1 vote
1 answer
295 views

Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)

I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
user avatar
1 vote
1 answer
184 views

Recover SHA1-encoded email addresses

Say you have a list of SHA1 hashes which are all encoded with the same salt. All of these are email addresses and you know at least one combination of hash and email address. Is it possible to use a ...
user avatar
  • 113
0 votes
2 answers
8k views

SHA 1 with RSA for ssl certificate

Hi using SHA 1 with RSA encryption for ssl certificate is secure? As i know, sha 1 is not secure, but if we use RSA with sha1, still it will be an issue? Please suggest if any security issues exist.
user avatar
  • 11
1 vote
1 answer
2k views

Same content different hash? [closed]

So I made a txt file using notepad and made a hash of it: SHA1: 701B6FAD6530C61528F9C11F024A9434B3C42D65 then I edited that file and took the hash again: SHA1: ...
user avatar
  • 13

1
2 3 4 5 6