Questions tagged [sha]

Secure Hash Algorithm is a family of cryptographic hash functions published by NIST. This includes SHA-1, and the SHA-2 and SHA-3 families of functions. SHA-1 is deprecated for all usages.

Filter by
Sorted by
Tagged with
0 votes
1 answer
44 views

Mapping arbitrary strings to hashes of 10 character length - time to crack it and collision probability [duplicate]

I would like to map strings of arbitrary length to hashes of 10 character length. The length of the alphabet is of 64 characters (0-9, A-Z, a-z, _, -). Obviously 2 same strings must produce the same ...
  • 103
32 votes
1 answer
4k views

Crashing the sha1() function in PHP?

I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here. Here is my methodology: Reset the ...
4 votes
1 answer
563 views

What is the math behind iterations in PBKDF2-SHA256 for lastpass users?

I am looking for a technical estimate of how bad the situation is regarding the recent hack of lastpass. The hack was covered by several outlets: Naked Security, Ars Technica. Lastpass has admitted ...
1 vote
1 answer
32 views

Javascript: How to check SHA of fetched script before executing

To save money and/or reduce system complexity, I am hosting a script on a server that I don't fully trust. My trust issue might be with the server itself, or the PKI setup on it. The reason doesn't ...
15 votes
1 answer
4k views

Is it a good practice to add hard-coded salt to BCrypt passwords?

I am currently learning about cybersecurity and trying to implement it in my next web application. I have been reading some articles about hashing, specifically SHA2 and Blowfish. In this article, it ...
2 votes
2 answers
115 views

FIPS 140-2 compliance implementation

I'm quite new to the security topic and encryption. Our software has to comply with FIPS 140-2. I have the following method (C#). In this case, the algorithm is AES256. What concerns me, is that we ...
1 vote
3 answers
248 views

Proving that a file existed at a time

How do I acquire the means to prove in the future that I had possission of a file now, without relying on the integrity of a single entity? (I believe one way of doing it would be to put the file ...
1 vote
1 answer
383 views

HMAC SHA256 by using a static key + text as a key

Maybe it's not a good idea, but I would like to check it with you. When using HMAC SHA to hash a clear text value (string max 30 char) I need to use a key (256) but in my scenario this key is static ...
2 votes
3 answers
3k views

How can I extract salt from encoded base64 Salted SHA 256 hashed password

I have a SSHA256 hashed password. Below is the plaintext and hashed password for it. PlainText -p@ssw0rd Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
0 votes
0 answers
150 views

Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?

I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
0 votes
0 answers
344 views

Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error

So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
  • 212
1 vote
2 answers
1k views

How many rounds of Bcrypt to use for security equivalent to SHA256?

We regularly use 10000 iterations of SHA256 for hashing passwords. If we want to have similar security, how many rounds/work factor should we use when hashing passwords with bcrypt?
  • 141
0 votes
3 answers
284 views

Why can't we produce original text from sha1 if there is no random salt attached [duplicate]

I have bunch of cat images whose names are sha1 of website where it was posted. Here is an example: 3afec3b4765f8f0a07b78f98c07b83f013567a0a.jpg website: http://www.example.com/image.jpg If sha1 is ...
  • 3
0 votes
1 answer
388 views

How hard is to reverse engineer a signature for a given message?

Given the following situation: User makes a request for temporary access to a video Backend responds with a json file containing timeAllowedInSeconds: 5 Backend also responds with the signature of ...
  • 101
1 vote
1 answer
341 views

Is MariaDB Server obsolete for PHP and Wordpress projects?

PHP (and by extension WordPress) only supports MySQL native & sha256 password authentication. MariaDB Server only supports MySQL native & ed25519 password authentication. Since MySQL native ...
8 votes
3 answers
4k views

Why not just use a small but unusual number of hashing rounds?

When it comes to hashing passwords, it is nowadays practice to do 100'000 or 200'000 iterations of SHA256/SHA512, or at least something in that ballpark. But my question is, why is it not safe enough ...
0 votes
1 answer
10k views

John the Ripper is unable to crack my SHA1 hashed password

John the Ripper is unable to crack my SHA1 hashed password: john --wordlist=rockyou.txt testing.txt Whenever I do this in Kali Linux, I get this response: Loaded 1 password hash (Raw-SHA1 [SHA1 256/...
0 votes
2 answers
369 views

Odds of two messages sharing the same hash prefix

If only the first h bits of a certain SHA256 hash H of a certain message M are known, and one had managed to successfully guess an input message M' whereby SHA256( M' ) yielded an H' whose first h ...
  • 111
0 votes
0 answers
33 views

Can I truncate a hash value and keep (the expected amount) of collision resistance? [duplicate]

I'm building a URL-shortening tool. For an arbitrary link, I need to produce a fixed-length slug which will index the full URL in a database. For prettiness reasons, I'd like to keep the slug ...
1 vote
2 answers
167 views

Are GNU coreutils SHA digest functions FIPS-validated (in NIST's Cryptographic Module Validation Program)?

My Challenge My project has a requirement that we use only FIPS-validated modules to do anything cryptographic, including generating checksums for binaries. We've been using the SHA-2 utilities ...
  • 113
1 vote
1 answer
663 views

Is using sensitive information to generate a UUID v5 considered secure?

Lets say I want to generate a name-based UUID using v5 of the RFC 4122 using sensitive information as the input (for example the password to my bank account). And lets say I give the generated UUID to ...
10 votes
4 answers
6k views

SHA & MD5 Collisions for shorter strings

This is not for passwords. I understand that MD5 and SHA-512, etc... are insecure because they can have collisions. However, is it still possible to have a collision if the string length is less than ...
1 vote
4 answers
1k views

Certificate SHA1 Thumbprint reported as a vulnerability [closed]

So a few weeks ago I came across a security report that stated that the SHA1 thumbprint of the certificate was a vulnerability. The vulnerability was raised due to fact that the thumbprint used the ...
1 vote
1 answer
480 views

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
1 vote
1 answer
507 views

Use the public key of a certificate as the key for HMAC SHA

Consider the following scenario. A company has several computers for each users on the same domain. They purchase an RSA certificate from a recognized authority which will be deployed with private / ...
1 vote
1 answer
103 views

Need a test vector for the putty ssh-2 file mac validation

I'm trying to implement the putty file format in one of my dart packages. Implementing the actual key loading was ok, but I'm struggeling with the mac validation. I'm not shure what I'm doing wrong ...
0 votes
3 answers
793 views

Different SHA256 checksum of same version of ssh binary on different machines

I was wondering if I compare SHA-256 of two binaries with same version on different machines, results will be two identical checksums. I tried this on ssh on macOS (Catalina). (I checked that ssh -V ...
5 votes
3 answers
2k views

How does the weakness of SHA-1 introduce attack vectors in SSH?

The security branch of my company worries that the use of older versions of OpenSSH (pre-7.4), where the only Key Exchange Algorithm available is SHA-1 is a major security issue. They suggest ...
  • 53
0 votes
0 answers
688 views

cracking HMAC-SHA1 when the password and seed are inverted

I happen to have a few hashes generated with code that did this (it has been changed to use a more "standard" bcrypt call): $ python3 >>> import hmac >>> hmac.new(b'The ...
  • 125
3 votes
4 answers
1k views

Is a SHA checksum enough to verify integrity and authenticity?

This is a broader question but here a concrete example: From apache.org: File hashes are used to check that a file has been downloaded correctly. They do not provide any guarantees as to the ...
  • 143
2 votes
1 answer
861 views

why CA use private key to sign a digital certificate? What is the logic behind sign a digital certificate with CA private key?

In general(PKI), encryption happens with public key and decryption happens with private key. But, how Certificate Authority sign a digital certificate with private key? How this can be validated using ...
28 votes
4 answers
7k views

How secure is this hash-based personal password scheme? [duplicate]

I use a password scheme where I keep a small number of easy to remember personal passwords. Instead of using the passwords directly for each service, I run them through a hashing algorithm first, as a ...
0 votes
0 answers
135 views

Risk of downgrading SHA-512 to SHA-1

I was working on a project where two programs are exchanging information over a network. I am having them generate a public/private RSA key pair to encrypt traffic. It seems that one of the ...
0 votes
0 answers
144 views

Does the entire certificate chain need to be signed with the agreed upon cipher under TLS? [duplicate]

Security Newbie, I'm using OpenSSL for my client, and noticed that when testing it against Bad ssl's sha1-intermediate test, it accepts it although the agreed upon cipher is ...
0 votes
1 answer
1k views

Can't solve format for Salted SHA1 hashes with Hashcat?

I am attempting to understand the format for this Salted SHA1 hash for an assignment. The line of text I was given was: nameExample@email.com,nameExample,nameExample@email.com,nameExample,,,...
-1 votes
1 answer
170 views

What type of hash is this? [closed]

Can anyone help me to find out what type of hash this is? I have it in this form: {SHA}vv359MeXQ+GgsEFZpf0No4HXxCg= But I don't think it is simply SHA1 I've tried to decode it with an sha1 ...
  • 1
1 vote
2 answers
341 views

Hash and data modification

If I have the MD5 and SHA1 hash matches for an encrypted container. Is there no possibility it's been modified? Is it safe to assume the container has never been modified?
7 votes
1 answer
384 views

Detect duplicates without exposing underlying data

We have a scenario where we need to prevent two users from using the same identifier. The identifier is sensitive (e.g. a social security number), so we do not want to store it in our DB. We just want ...
0 votes
1 answer
402 views

Does it increase security to hash a SHA1 hash with a common salt with SHA256 with individual salt [duplicate]

I tried to find a similar question but I did not find a question describing my exact scenario and I am still puzzled if the following actually makes an application more secure. I have legacy ...
0 votes
0 answers
151 views

Web Site Access - Port Whitelisting

I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine ...
2 votes
1 answer
153 views

Why would Chrome return non-deterministic bytes for a versioned release? [closed]

From the: Abusing SHA-1 collisions for Chromium updates https://news.ycombinator.com/item?id=20114809 https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/networking/browsers/chromium/...
1 vote
3 answers
343 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
  • 137
1 vote
3 answers
2k views

Which function to hash 128 bit API key with?

I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
  • 279
3 votes
0 answers
71 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
  • 131
1 vote
1 answer
361 views

Safe to switch from PBKDF2 to SHA-1 for token verification?

Whenever I need to generate a token (email account confirmation, password reset, remember me cookie, view email in browser etc) I generate a string of random bytes (typically 32 using the Fortuna PRNG)...
  • 113
-1 votes
1 answer
274 views

Can one alter SHA-1 input data without changing the hash internal state? [duplicate]

Let's say I have an input message of "enoughly long" length (I'll got for a 128 bytes long message, but it might be 256 or whatever). I know the hash sha1(message || secret) where || is byte ...
  • 1,341
17 votes
2 answers
13k views

What are SHA-rounds?

I understand more sha-rounds make it difficult to bruteforce the hashed password in /etc/shadow. Higher rounds also use more CPU processing when executing sudo commands and logging into the Unix ...
-1 votes
1 answer
432 views

Best tool for cracking SHA-1s with unique pre and post salts? [closed]

I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
  • 474
3 votes
1 answer
3k views

SHA1 signature in a SAML request

I'm currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider. I'm not too familiar with SAML, but during the authentication, the sent SAMLRequest ...
4 votes
2 answers
3k views

Are the sha1 hashes used by common ssh configurations insecure?

I got an automated PCI security test result that checked various server configurations. The automated test determined the server to be unsafe due to the use of sha1 algorithm in some elements of the ...
  • 560

1
2 3 4 5
7