Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sha]

Secure Hash Algorithm is a family of cryptographic hash functions published by NIST. This includes SHA-1, and the SHA-2 and SHA-3 families of functions.

-4
votes
2answers
106 views

How secure is my hashing algorithm? [duplicate]

This is probably the common question on stack exchange but I need to know is this really safe as it seems to be? //Password hashing stage 1 $a_password = sha1($a_password); $a_password = md5($...
0
votes
1answer
46 views

SHA 1 with RSA for ssl certificate

Hi using SHA 1 with RSA encryption for ssl certificate is secure? As i know, sha 1 is not secure, but if we use RSA with sha1, still it will be an issue? Please suggest if any security issues exist.
0
votes
1answer
103 views

Same content different hash? [closed]

So I made a txt file using notepad and made a hash of it: SHA1: 701B6FAD6530C61528F9C11F024A9434B3C42D65 then I edited that file and took the hash again: SHA1: ...
1
vote
1answer
128 views

How to increase the time for an offline password attack

I am trying to answer a CASP exam practice question. Could someone comment on the options below regarding the logic behind each item? Where is the logical error behind each statement? A Storage-...
1
vote
1answer
76 views

Disabling SHA-1 in TLS handshake in Linux

As SHA-1 is not recommended, I want to disable the SHA-1 hash algorithm. I used OpenSSL API to set signature algorithm to SSL_CTX, static INT32 signAlgoList[24] = { NID_sha512, EVP_PKEY_RSA, ...
2
votes
3answers
245 views

Are mkpasswd SHA512 hashes secure for the public?

I am no crypto expert in any way so please bear with me if my question is kind of stupid. We use OpenSSH key pairs on a regular basis and due to the asymmetric nature of key pairs, as far as I ...
0
votes
1answer
160 views

Calculating Entropy using md5sum, sha256sum etc

We can calculate the Entropy S of a string simply like this: S = L * log_2(N) Where L stands for used characters in the string And N for every possible character Example: We want to calculate the ...
3
votes
1answer
202 views

Why aren’t collisions important with HMAC?

SHA-1 is broken because collisions can be found in substantially fewer hash operations than naive brute-force would suggest. HMAC-SHA1 is fine, however, because for HMAC “collisions aren’t important.” ...
4
votes
2answers
1k views

How to reverse engineer password from /etc/shadow

I failed to answer a question in a CaptureTheFlag event, and the the question still bugs me. I want to share the question here and please help me if you know the solution. Question: You have the ...
0
votes
1answer
491 views

Is SHA synonymous with SHA1 or SHA0?

There is so little info and so much confusion out there. People often equate SHA2 as being SHA256; so then would SHA be 160 bit, also known as SHA1? Is SHA depreciated like SHA1? Are they the same ...
0
votes
1answer
276 views

Conversion of user passwords from SHA-1 & encrypting plaintext data [duplicate]

I'm currently working on conversion of an old database format where user login passwords were stored as SHA-1 hashes. That same table also contains other user data that is stored in plaintext. My ...
17
votes
2answers
4k views

How secure is BCRYPT(SHA1(Password)) [duplicate]

This question is a fork from a previous question here: Is it safe/wise to store a salt in the same field as the hashed password? Assume you run a web portal, and store passwords in SHA1 hashes. How ...
1
vote
0answers
223 views

How get serial number (or SHA1 Hash) certificate without private key? [closed]

I'm trying to get a serial number ( like $ssl_client_serial in nginx ) certificate without the private key and I don't know how to do it. I have drawn a scheme: client <- HTTPS -> HAproxy or ...
1
vote
0answers
475 views

Check the signature algorithm of RDP certificate

I received a Nessus warning of RDP as following, The following certificates were part of the certificate chain sent by the remote host, but contain hashes that are considered to be weak. |-Subject ...
2
votes
2answers
499 views

Would using both SHA1 and MD5 hashes of files help reduce the risk of deleting non duplicates

I'm making a program to compare all the files on a 3Tb drive by hash and delete duplicates. I was initially going to use MD5, but was worried that with 3Tb of files, there was a slight chance of a ...
1
vote
2answers
343 views

is it secure to use sha256 to hash 64 cryptographically random byte data with 12 byte salt?

I read from a lot of sources that sha256 is not secure because it is fast. Most links that I read suggested bcrypt. However, I just want to know that if data is 64 cryptographically random byte, will ...
0
votes
0answers
266 views

OpenLDAP security SSHA [duplicate]

In OpenLDAP documentation I can find information that it supports the following encryption schemes: MD5, SMD5, SHA and SSHA. From these schemes the most secure is SSHA (SHA-1 with salt), but it still ...
1
vote
1answer
64 views

How often ciphers are used through an IPSEC session

I’m wondering how often a terminal needs to perform a cryptographic hash (ex: SHA) throughout the lifetime of an IPSEC session where both ends are authenticated using certificates. From what I can ...
2
votes
3answers
420 views

Using BCrypt to transmit sensitive data in client/server configuration

I'm developing a software in which I need to transmit sensitive data (passwords) in a server/client configuration using TCP. All data is encrypted using AES (the symmetric key is unique to each ...
0
votes
1answer
1k views

HMAC-SHA256 for JWT Token Signature

I am currently working at a company in which we have the need to design a token based authentication system. We will be the owners and controlers of two servers, one being the authentication server ...
3
votes
1answer
161 views

Are many rounds of SHA needed for a random veracrypt key

Assume that I've used white noise from the classic "zener breakdown" circuit to produce 512 bits of random data. If I use these as the key to a Veracrypt volume, is there any benefit to running 200,...
7
votes
3answers
4k views

Is it required to have the same Domain Name and Common Name for SSL Certificate?

I have an SSL cert in which CN is "abc.xyz.com". But the url shared to 3rd party organization to access a web app on our server is: "def.stu.com/what-ever". When this arrangement is working for ...
0
votes
1answer
55 views

How to check if some encryptions are disabled in OpenSSL?

I want to check if the following encryptions are disabled in the openssl-1.0.2l TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_RSA_WITH_RC4_128_SHA ...
2
votes
1answer
85 views

Can an attacker replace the hash of a download, a download, and the public key?

I have a question about DSA and GPG. Suppose you are trying to verify a downloaded file is 'legit' (i.e., no malicious code and it is the intended file). I'll just use Ubuntu's 16.04 LTS ISO image as ...
0
votes
1answer
34 views

Is it less secure to sign the semantic representation of payload then the lexical representation?

I think an example illustrates my questions best. Let's say that I want to send a JSON message. { "payload": { "b": 5, "a": 1 }, "signature": "...9oZRsvygw1pTFuRcfXXpFKMRBmkrzdTn6lzS..." } ...
0
votes
2answers
258 views

Inconsistency Among MD5, SHA1, and SHA256 Hashing Protocols

There appears to be an inconsistency (or unpublished protocol) in many online hash generators when formulating a hash from an uploaded text file, versus strictly hashing the contents of a file. This ...
1
vote
0answers
92 views

How Secure Would Client Side Sha-512 Be In JavaScript

I've created an Capture The Flag challenge for me and a few of my mates, and for the final challenge, you're goal is to log in as admin to a site. Now the site doesn't use any server side languages (...
0
votes
1answer
180 views

Is the sha1 deprecation a problem for **client** certificates?

For my web application, users connect to a web server in HTTPS and need to have a client certificate installed on their computer/browser. I understand that the sha1 deprecation is important for ...
3
votes
1answer
723 views

How find the hash creation method knowing password, salt, and resulting hash?

If I know the password, the salt (supposed salt actually) and the output hash (sha1 format). How can I find the hash creation method ? I tried basic stuff like sha1(salt+password) sha1(...
1
vote
1answer
460 views

SHA256 for IV for AES-256 CBC?

When making an IV for AES-256 CBC mode the IV should be random and shouldn't be able to be guessed. If I were to use the rand() function in C, seeded with time(NULL) to generate sim random numbers ...
0
votes
1answer
180 views

Is it safe to use SHA-512 to identify credit card?

I am thinking if using one-way function like SHA-512 is considered to be safe for application on credit card numbers. The credit card number is 13-19 number with known BIN range (6-8 numbers) and the ...
0
votes
1answer
718 views

Should I use SHA-512 with many rounds or bcrypt/scrypt

I am currently using SHA-512 with 100000 rounds because of the easier implementation. The algorithm generates passwords from a service (e.g amazon) and a master password. Would I benefit from ...
2
votes
2answers
446 views

Why are hash collisions big news?

Why is it big news to find a hash collision like https://news.ycombinator.com/item?id=13713480? I'm not asking about the implications. It seems like all you'd have to do to find a collision would be ...
4
votes
2answers
349 views

Does still make sense to use SHA1?

I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying ...
-1
votes
2answers
188 views

How can I make a program to verify file integrity? [closed]

How to make a program that calculates a checksum of a file? What is the exact process of calculating a checksum?
0
votes
1answer
271 views

Is it insecure to use PBKDF2 on a SHA1 hashed password? [duplicate]

If you already have SHA1 hashed passwords and you're trying to migrate to a better password hashing algorithm, is it less secure to just use PBKDF2 to hash the SHA1 hashes you already have instead of ...
-3
votes
1answer
202 views

Why can't hashes be reversed? [closed]

Imagine a theoretical universe where reverse hashing is possible. What if I take a 5000 bit message and hash it. So now I get a hashed string of say 256 bits. If I can get back to the 5000 bit message(...
1
vote
0answers
1k views

How to reasonably hash a composite key into a UUID?

The Problem In our system users are identified by a composite key. We'd like to devise a scheme to deterministically convert this composite key into a UUID. Solutions? The obvious first suggestion ...
0
votes
3answers
305 views

What's wrong with SHA-1 having collisions? [duplicate]

Say you go onto a website and are downloading a program. Next to the file there is a SHA-1 checksum of the file. You download the program, verify the checksum and find that it is the same as the one ...
0
votes
1answer
95 views

With the recent denouncing of SHA-1 by Google, should SHA-1 based PBDKF2 now be avoided? [duplicate]

Google recently announced "the first practical technique for generating a collision" for SHA-1. I'm currently planning a password hashing implementation for a website, and historically we have used ...
2
votes
4answers
372 views

How is knowing a specific collision of hashing algorithm useful? [duplicate]

Not too long ago the first collision of the SHA-1 was found. If I get this right, that means that someone found two different inputs that give the same output. Two different messages give the same ...
2
votes
2answers
6k views

How does this site decrypt SHA256 hashes? [duplicate]

I thought sha256 is impossible to crack (so far). But I saw a website, that could decrypt my hash. So is this because they store known hastes in a database or do they really decrypt hashes? Here's an ...
1
vote
0answers
33 views

Why Signature Hash Algo SHA-1 still uses for X509 by GeoTrust [duplicate]

Google has successfully shattered SHA-1 and still I found that SHA-1 digest algorithm is used for signing the hash. Even Google Chrome is accepting this kind of certificate without any kind of warning....
0
votes
1answer
93 views

SHA-1 deprecation and self signed internally used certificates [duplicate]

I was wondering whether SHA-1 deprecation would create any security concern for self signed (internally used) already existing certificates. What is the right thing to do in this case? Since the ...
4
votes
3answers
263 views

SHA-1 how and when is it really a problem

First, here’s my interpretation of the certificate validation process (if mistaken, please feel more than free to correct me). When connecting to a web site using https, the website present an SSL ...
4
votes
2answers
867 views

SHA1 Root Certificate Authorities [duplicate]

My understanding is that SHA1 is pretty much considered obsolete. Yet, I just opened the Trusted Root Certificate Authorities on my Windows 10 computer and I see that most Trusted Root Certificate ...
0
votes
2answers
620 views

Kali Linux SHA1 checksum changed during and after download

I was downloading Kali Linux (via direct download) and noticed that the SHA1 checksum during download was different to the official values provided. However, after the download was completed, the ...
3
votes
2answers
117 views

Can a time stamp protect a signature with the obsolete SHA1?

I am trying to figure out the scope of SHA1 deprecation for existent signatures. Reading this.An attacker (after 110 years) could present a fake document for a valid signature I believe this only ...
1
vote
2answers
167 views

How can we retire SHA1 in prefernce to SHA256 or SHA-3?

According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could ...
2
votes
2answers
805 views

Is there a good 160 bit alternative for SHA-1?

SHA-1 has long been considered insecure, and now the attacks have been demonstrated in practice also. The proposed alternative for SSL certificates is the SHA-2 suite of hash functions, of which SHA-...