Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sha]

Secure Hash Algorithm is a family of cryptographic hash functions published by NIST. This includes SHA-1, and the SHA-2 and SHA-3 families of functions.

0
votes
1answer
27 views

SHA 1 with RSA for ssl certificate

Hi using SHA 1 with RSA encryption for ssl certificate is secure? As i know, sha 1 is not secure, but if we use RSA with sha1, still it will be an issue? Please suggest if any security issues exist.
0
votes
1answer
95 views

Same content different hash? [closed]

So I made a txt file using notepad and made a hash of it: SHA1: 701B6FAD6530C61528F9C11F024A9434B3C42D65 then I edited that file and took the hash again: SHA1: ...
1
vote
1answer
120 views

How to increase the time for an offline password attack

I am trying to answer a CASP exam practice question. Could someone comment on the options below regarding the logic behind each item? Where is the logical error behind each statement? A Storage-...
1
vote
1answer
61 views

Disabling SHA-1 in TLS handshake in Linux

As SHA-1 is not recommended, I want to disable the SHA-1 hash algorithm. I used OpenSSL API to set signature algorithm to SSL_CTX, static INT32 signAlgoList[24] = { NID_sha512, EVP_PKEY_RSA, ...
2
votes
3answers
170 views

Are mkpasswd SHA512 hashes secure for the public?

I am no crypto expert in any way so please bear with me if my question is kind of stupid. We use OpenSSH key pairs on a regular basis and due to the asymmetric nature of key pairs, as far as I ...
0
votes
1answer
155 views

Calculating Entropy using md5sum, sha256sum etc

We can calculate the Entropy S of a string simply like this: S = L * log_2(N) Where L stands for used characters in the string And N for every possible character Example: We want to calculate the ...
3
votes
1answer
146 views

Why aren’t collisions important with HMAC?

SHA-1 is broken because collisions can be found in substantially fewer hash operations than naive brute-force would suggest. HMAC-SHA1 is fine, however, because for HMAC “collisions aren’t important.” ...
4
votes
2answers
788 views

How to reverse engineer password from /etc/shadow

I failed to answer a question in a CaptureTheFlag event, and the the question still bugs me. I want to share the question here and please help me if you know the solution. Question: You have the ...
0
votes
1answer
324 views

Is SHA synonymous with SHA1 or SHA0?

There is so little info and so much confusion out there. People often equate SHA2 as being SHA256; so then would SHA be 160 bit, also known as SHA1? Is SHA depreciated like SHA1? Are they the same ...
0
votes
1answer
250 views

Conversion of user passwords from SHA-1 & encrypting plaintext data [duplicate]

I'm currently working on conversion of an old database format where user login passwords were stored as SHA-1 hashes. That same table also contains other user data that is stored in plaintext. My ...
17
votes
2answers
3k views

How secure is BCRYPT(SHA1(Password)) [duplicate]

This question is a fork from a previous question here: Is it safe/wise to store a salt in the same field as the hashed password? Assume you run a web portal, and store passwords in SHA1 hashes. How ...
1
vote
0answers
194 views

How get serial number (or SHA1 Hash) certificate without private key? [closed]

I'm trying to get a serial number ( like $ssl_client_serial in nginx ) certificate without the private key and I don't know how to do it. I have drawn a scheme: client <- HTTPS -> HAproxy or ...
1
vote
0answers
435 views

Check the signature algorithm of RDP certificate

I received a Nessus warning of RDP as following, The following certificates were part of the certificate chain sent by the remote host, but contain hashes that are considered to be weak. |-Subject ...
2
votes
2answers
371 views

Would using both SHA1 and MD5 hashes of files help reduce the risk of deleting non duplicates

I'm making a program to compare all the files on a 3Tb drive by hash and delete duplicates. I was initially going to use MD5, but was worried that with 3Tb of files, there was a slight chance of a ...
1
vote
2answers
275 views

is it secure to use sha256 to hash 64 cryptographically random byte data with 12 byte salt?

I read from a lot of sources that sha256 is not secure because it is fast. Most links that I read suggested bcrypt. However, I just want to know that if data is 64 cryptographically random byte, will ...
0
votes
0answers
154 views

OpenLDAP security SSHA [duplicate]

In OpenLDAP documentation I can find information that it supports the following encryption schemes: MD5, SMD5, SHA and SSHA. From these schemes the most secure is SSHA (SHA-1 with salt), but it still ...
1
vote
1answer
60 views

How often ciphers are used through an IPSEC session

I’m wondering how often a terminal needs to perform a cryptographic hash (ex: SHA) throughout the lifetime of an IPSEC session where both ends are authenticated using certificates. From what I can ...
2
votes
3answers
387 views

Using BCrypt to transmit sensitive data in client/server configuration

I'm developing a software in which I need to transmit sensitive data (passwords) in a server/client configuration using TCP. All data is encrypted using AES (the symmetric key is unique to each ...
0
votes
1answer
1k views

HMAC-SHA256 for JWT Token Signature

I am currently working at a company in which we have the need to design a token based authentication system. We will be the owners and controlers of two servers, one being the authentication server ...
3
votes
1answer
149 views

Are many rounds of SHA needed for a random veracrypt key

Assume that I've used white noise from the classic "zener breakdown" circuit to produce 512 bits of random data. If I use these as the key to a Veracrypt volume, is there any benefit to running 200,...
7
votes
3answers
3k views

Is it required to have the same Domain Name and Common Name for SSL Certificate?

I have an SSL cert in which CN is "abc.xyz.com". But the url shared to 3rd party organization to access a web app on our server is: "def.stu.com/what-ever". When this arrangement is working for ...
0
votes
1answer
54 views

How to check if some encryptions are disabled in OpenSSL?

I want to check if the following encryptions are disabled in the openssl-1.0.2l TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_RSA_WITH_RC4_128_SHA ...
2
votes
1answer
77 views

Can an attacker replace the hash of a download, a download, and the public key?

I have a question about DSA and GPG. Suppose you are trying to verify a downloaded file is 'legit' (i.e., no malicious code and it is the intended file). I'll just use Ubuntu's 16.04 LTS ISO image as ...
0
votes
1answer
34 views

Is it less secure to sign the semantic representation of payload then the lexical representation?

I think an example illustrates my questions best. Let's say that I want to send a JSON message. { "payload": { "b": 5, "a": 1 }, "signature": "...9oZRsvygw1pTFuRcfXXpFKMRBmkrzdTn6lzS..." } ...
0
votes
2answers
237 views

Inconsistency Among MD5, SHA1, and SHA256 Hashing Protocols

There appears to be an inconsistency (or unpublished protocol) in many online hash generators when formulating a hash from an uploaded text file, versus strictly hashing the contents of a file. This ...
1
vote
0answers
91 views

How Secure Would Client Side Sha-512 Be In JavaScript

I've created an Capture The Flag challenge for me and a few of my mates, and for the final challenge, you're goal is to log in as admin to a site. Now the site doesn't use any server side languages (...
0
votes
1answer
164 views

Is the sha1 deprecation a problem for **client** certificates?

For my web application, users connect to a web server in HTTPS and need to have a client certificate installed on their computer/browser. I understand that the sha1 deprecation is important for ...
3
votes
1answer
637 views

How find the hash creation method knowing password, salt, and resulting hash?

If I know the password, the salt (supposed salt actually) and the output hash (sha1 format). How can I find the hash creation method ? I tried basic stuff like sha1(salt+password) sha1(...
1
vote
1answer
410 views

SHA256 for IV for AES-256 CBC?

When making an IV for AES-256 CBC mode the IV should be random and shouldn't be able to be guessed. If I were to use the rand() function in C, seeded with time(NULL) to generate sim random numbers ...
0
votes
1answer
157 views

Is it safe to use SHA-512 to identify credit card?

I am thinking if using one-way function like SHA-512 is considered to be safe for application on credit card numbers. The credit card number is 13-19 number with known BIN range (6-8 numbers) and the ...
0
votes
1answer
678 views

Should I use SHA-512 with many rounds or bcrypt/scrypt

I am currently using SHA-512 with 100000 rounds because of the easier implementation. The algorithm generates passwords from a service (e.g amazon) and a master password. Would I benefit from ...
2
votes
2answers
399 views

Why are hash collisions big news?

Why is it big news to find a hash collision like https://news.ycombinator.com/item?id=13713480? I'm not asking about the implications. It seems like all you'd have to do to find a collision would be ...
4
votes
2answers
316 views

Does still make sense to use SHA1?

I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying ...
-1
votes
2answers
132 views

How can I make a program to verify file integrity? [closed]

How to make a program that calculates a checksum of a file? What is the exact process of calculating a checksum?
0
votes
1answer
236 views

Is it insecure to use PBKDF2 on a SHA1 hashed password? [duplicate]

If you already have SHA1 hashed passwords and you're trying to migrate to a better password hashing algorithm, is it less secure to just use PBKDF2 to hash the SHA1 hashes you already have instead of ...
-3
votes
1answer
201 views

Why can't hashes be reversed? [closed]

Imagine a theoretical universe where reverse hashing is possible. What if I take a 5000 bit message and hash it. So now I get a hashed string of say 256 bits. If I can get back to the 5000 bit message(...
0
votes
0answers
880 views

How to reasonably hash a composite key into a UUID?

The Problem In our system users are identified by a composite key. We'd like to devise a scheme to deterministically convert this composite key into a UUID. Solutions? The obvious first suggestion ...
0
votes
3answers
283 views

What's wrong with SHA-1 having collisions? [duplicate]

Say you go onto a website and are downloading a program. Next to the file there is a SHA-1 checksum of the file. You download the program, verify the checksum and find that it is the same as the one ...
0
votes
1answer
92 views

With the recent denouncing of SHA-1 by Google, should SHA-1 based PBDKF2 now be avoided? [duplicate]

Google recently announced "the first practical technique for generating a collision" for SHA-1. I'm currently planning a password hashing implementation for a website, and historically we have used ...
2
votes
4answers
344 views

How is knowing a specific collision of hashing algorithm useful? [duplicate]

Not too long ago the first collision of the SHA-1 was found. If I get this right, that means that someone found two different inputs that give the same output. Two different messages give the same ...
2
votes
2answers
5k views

How does this site decrypt SHA256 hashes? [duplicate]

I thought sha256 is impossible to crack (so far). But I saw a website, that could decrypt my hash. So is this because they store known hastes in a database or do they really decrypt hashes? Here's an ...
1
vote
0answers
32 views

Why Signature Hash Algo SHA-1 still uses for X509 by GeoTrust [duplicate]

Google has successfully shattered SHA-1 and still I found that SHA-1 digest algorithm is used for signing the hash. Even Google Chrome is accepting this kind of certificate without any kind of warning....
0
votes
1answer
91 views

SHA-1 deprecation and self signed internally used certificates [duplicate]

I was wondering whether SHA-1 deprecation would create any security concern for self signed (internally used) already existing certificates. What is the right thing to do in this case? Since the ...
4
votes
3answers
247 views

SHA-1 how and when is it really a problem

First, here’s my interpretation of the certificate validation process (if mistaken, please feel more than free to correct me). When connecting to a web site using https, the website present an SSL ...
4
votes
2answers
805 views

SHA1 Root Certificate Authorities [duplicate]

My understanding is that SHA1 is pretty much considered obsolete. Yet, I just opened the Trusted Root Certificate Authorities on my Windows 10 computer and I see that most Trusted Root Certificate ...
0
votes
2answers
583 views

Kali Linux SHA1 checksum changed during and after download

I was downloading Kali Linux (via direct download) and noticed that the SHA1 checksum during download was different to the official values provided. However, after the download was completed, the ...
3
votes
2answers
115 views

Can a time stamp protect a signature with the obsolete SHA1?

I am trying to figure out the scope of SHA1 deprecation for existent signatures. Reading this.An attacker (after 110 years) could present a fake document for a valid signature I believe this only ...
1
vote
2answers
164 views

How can we retire SHA1 in prefernce to SHA256 or SHA-3?

According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could ...
2
votes
2answers
718 views

Is there a good 160 bit alternative for SHA-1?

SHA-1 has long been considered insecure, and now the attacks have been demonstrated in practice also. The proposed alternative for SSL certificates is the SHA-2 suite of hash functions, of which SHA-...
1
vote
1answer
728 views

Differences between the OpenVPN SHA1 variations in the digest aglorithms

OpenVPN offers the use of various digest algorithms (see list below). I've read that the the digests, printed with a leading RSA-, DSA- or ecdsa-with- are simply due to a print function in OpenSSL and ...