Questions tagged [sha256]
Sha256 is a hashing algorithm.
4
votes
6answers
420 views
How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?
Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives.
I wonder how much safer is the use of the SHA256 hashes for integrity checks?
Note: Consider ...
0
votes
1answer
35 views
How are these transaction fingerprints colored?
For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
0
votes
3answers
145 views
Is it easier to calculate a partial SHA256 collision than a full one?
Question: Disregarding brute-force, is it any easier to calculate a partial hash collision, in which only a certain number of bits match?
Reasoning: On many websites you find hashes for file ...
1
vote
1answer
112 views
Error detection capability of SHA-256
If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors?
For example, reading the page about error correction and detection here, under the ...
0
votes
0answers
181 views
How to mask attack a sha256 hash with following information using hashcat?
I am hashcat newbie and I want to crack a hash :)
The answer is 1-15 (unknown) characters and it may contain 'a-z' 'A-Z' '0-9' and '_' . (A Twitter username)
How may I mask attack a hash with above ...
5
votes
2answers
2k views
Why is SHA-256 not good for passwords? [duplicate]
I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 ...
1
vote
2answers
59 views
Confusion about the software and also the digital signature getting modified
I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted ...
2
votes
1answer
136 views
Is it possible to tell if a file's message digest is MD5 or SHA-256?
There's some old data encrypted with OpenSSL 1.0.2, but now OpenSSL is at 1.1.0. I understand from OpenSSL FAQ USER3 that an old file can be decrypted with 1.1.0 by using -md md5. But let's say you ...
2
votes
1answer
1k views
How to decrypt a gpg file?
I have a gpg file and a sha256 file. When I try to decrypt the gpg file using the gpg - d file.gpg command, it says that there is no secret key. I am absolutely new to this so I would appreciate any ...
3
votes
1answer
106 views
when should i use HMAC-based JWT?
I read a number of blog posts and found that it is tough to keep the secret-key a secret and if using a symmetric algorithm for JWT creation, the generator has the power to create as well as validate ...
-2
votes
1answer
54 views
SHA256 Encrypting with Value [closed]
Is it possible to encrypt a value (such as "hello world") with itself ("hello world") using an encrypting technique such as SHA256? Is that safe to do or would it be easily compromised?
0
votes
2answers
99 views
Sha256 hash + secret GUID + RNGCrypto random number to hash passwords
I'm maintaining a website which uses Sha256 hashing of passwords.
The passwords are hashed with a GUID key, and a RNGCrypto generated random salt.
I'm just trying to understand the security risks ...
0
votes
1answer
294 views
Generating salt for hash that occurs on server and client
Let's say I have an API call which is supposed to check if email address exists in the DB, without transmitting the actual email address.
For that purpose, I've decided to store SHA256 hash of the ...
3
votes
2answers
307 views
Can AES and SHA-256 outputs with the same inputs be used to break each other?
An abstract representation of my question looks like this:
byte[] encrypted = AES.Encrypt(bytesToEncrypt, password);
byte[] hash = SHA256.Hash(password);
If an attacker obtains the values of both ...
53
votes
5answers
11k views
Is it secure to use MD5 to verify the integrity of small files (less than 15kb)?
I know that collision for MD5 has been documented since the 90s and that digital certificates based off of MD5 has been demonstrated to be completely compromised back in 2010 but how effective is MD5 ...
1
vote
3answers
173 views
Should Hashes of Sensitive Data be Encrypted
I'm planning on storing chunks of encrypted data inside a file, along with each chunk would be the hash(sha256) of the unencrypted chunk stored in the file as well. Is storing the hash secure?
6
votes
2answers
312 views
Is it safe to use a Windows executable with expired SHA256 certificate but valid SHA1 certificate?
Microsoft's Media Creation Tool to create Windows 10 installation media has a SHA1 digital signature and a SHA256 digital signature (shown via file properties). However, the certificate for SHA256 ...
1
vote
2answers
1k views
Decoding a HMAC SHA256 when the key is the same as the original string
Theoretically, python function for encrypting a HMAC SHA256 looks like this:
hmac_sha256(key, text)
The word "hello" was encrypted using the function like so:
hmac_sha256("hello", "hello")
How ...
0
votes
3answers
87 views
Producing secure hashes to detect data manipulation
I have an Android app that internally relies on a SQLite database that stores encrypted user data. The data is encrypted using AES-256, with a key generated by the PBKDF2-HMACSHA256 algorithm. The ...
2
votes
0answers
87 views
How bad is it to generate passwords via sha256, rather than storing them with a pw manager? [duplicate]
I've been pondering how to deal with passwords lately. I'd been using a password manager for awhile, but this means I can't access anything I use it for from a machine where it isn't installed (or ...
7
votes
3answers
263 views
Hashing a large file on an embedded system
I'm trying to come up with a way to verify the authenticity of a file that I'm downloading from a server to an embedded system. I'm thinking of using a hash (SHA256 preferably). My main concern is ...
2
votes
4answers
2k views
Is using 100,000 iterations of sha256 good enough for password storage? [duplicate]
I am creating a web app, and I was wondering if it would be secure to use 100,000 iterations of sha256 for storing passwords? I know that there are algorithms such as scrypt and bcrypt, however, I was ...
3
votes
1answer
141 views
How is the bitcoin block header data padded for SHA256 hashing?
I see that a block contains 80 bytes. SHA256 expects integral multiples of 64 bytes as input. How are the remaining 48 bytes calculated?
0
votes
1answer
1k views
HMAC-SHA256 for JWT Token Signature
I am currently working at a company in which we have the need to design a token based authentication system. We will be the owners and controlers of two servers, one being the authentication server ...
1
vote
1answer
264 views
Interoperability of openssl smime, rsautl & dgst
How do
$ openssl smime -sign -in test -text -out mail.msg -signer mycert.pem -inkey key.key
and
$ openssl rsautl -sign -inkey key.key -out test.sgn -in test
and
$ openssl dgst -sha256 -sign key....
2
votes
1answer
91 views
E-Mail signature examination
If I download a signed e-mail from thunderbird, it looks like this:
Content-Type: multipart/signed; protocol="application/pkcs7-signature";
micalg=sha-256; boundary="------------...
2
votes
2answers
67 views
Analysis of gpg2 packets
I want to mentally visualize or just understand a gpg-signature.
When running
$ gpg2 --list-packets --verbose < test.sig
the output is
# off=0 ctb=89 tag=2 hlen=3 plen=540
:signature packet: ...
3
votes
2answers
255 views
Why are passwords sent unhashed by most modern websites? [duplicate]
I've been investigating various protocols used to send usernames and passwords to web servers in order to authenticate, and while obviously all of them these days use SSL/TLS, I was a bit surprised to ...
4
votes
1answer
242 views
Is appending a salt before hash generation enough
I have what I think is a securely generated salt/hashing mechanism for HMAC authentication based on SHA256 in place. However, I'm using the salt in, from what I can see, a fairly standard way of just ...
0
votes
1answer
101 views
Given a hash value, is it possible to determine the length of the initial string that was digested? (SHA256)
Also, given two hash values, is it possible to determine if either one of them was a result of digesting a larger string?
As far as I understand SHA256, nothing but guessing the string itself helps. ...
1
vote
0answers
369 views
ways to check a certificate fingerprint against known logs
Suppose I have a certificate sha-256 fingerprint, which I can obtain say visiting the relevant domain in firefox or from a shell script using openssl, and i want to verify this fingerprint. one option ...
1
vote
1answer
165 views
compare sha-256 fingerpirnt of certificate with google transparency report
Say that I want to check an https certificate. Suppose I know its SHA-256 fingerprint, how do I compare it to this service search tool, which apparently only gives me the serial number?
edit1: can ...
0
votes
2answers
272 views
Inconsistency Among MD5, SHA1, and SHA256 Hashing Protocols
There appears to be an inconsistency (or unpublished protocol) in many online hash generators when formulating a hash from an uploaded text file, versus strictly hashing the contents of a file. This ...
0
votes
1answer
93 views
Can a secret, S, be efficiently recovered from a list of usernames and SHA256(S + username)s?
Given a set of usernames and their corresponding proofs of knowledge of a shared secret: SHA256($SECRET + username), can an attacker recover $SECRET more efficiently than by brute force?
(This is ...
0
votes
0answers
50 views
Expand key for hmac function
My app works like this:
User sends data to server.
Server responses with token and also server sends to user sms with a six-number code.
User sends to server data,token and code for verifying ...
1
vote
1answer
522 views
SHA256 for IV for AES-256 CBC?
When making an IV for AES-256 CBC mode the IV should be random and shouldn't be able to be guessed.
If I were to use the rand() function in C, seeded with time(NULL) to generate sim random numbers ...
5
votes
2answers
7k views
Is SHA-256 + Salt still safe for password storage? [duplicate]
I am developing a website which requires users to register to it in order to use it's functions and I was wondering if SHA-256 + salt (random salt provided by RNGCryptoServiceProvider in C#) is ...
-1
votes
2answers
264 views
How can I make a program to verify file integrity? [closed]
How to make a program that calculates a checksum of a file? What is the exact process of calculating a checksum?
1
vote
0answers
1k views
How to reasonably hash a composite key into a UUID?
The Problem
In our system users are identified by a composite key. We'd like to devise a scheme to deterministically convert this composite key into a UUID.
Solutions?
The obvious first suggestion ...
2
votes
2answers
6k views
How does this site decrypt SHA256 hashes? [duplicate]
I thought sha256 is impossible to crack (so far).
But I saw a website, that could decrypt my hash.
So is this because they store known hastes in a database or
do they really decrypt hashes?
Here's an ...
1
vote
2answers
176 views
How can we retire SHA1 in prefernce to SHA256 or SHA-3?
According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could ...
1
vote
2answers
2k views
Brute force HMAC SHA256 (HS256） equals to break JSON web token signature?
The format of JSON Web Token is:
encoded (header). encoded(payload). signature with a secret (for example, use sha256 to sign).
In case of hmac sha256 (HS256)-selected JWT, if the secret is not long ...
8
votes
1answer
2k views
What kind of hashing to use for storing REST API tokens in the database?
We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication ...
0
votes
2answers
3k views
Recover key in HMAC-SHA256 message authentication [closed]
I am working on a demonstration of cookie security, where some important data is passed to the client along with a HMAC-SHA256 digest to prevent modification of the data. I would like to be able to ...
0
votes
1answer
263 views
SMS Encryption with Hashing [closed]
I need help, I want to send a encrypted SMS from Alice to Bob, where does hashing comes in here? How do I use the hashing??
1
vote
1answer
195 views
can the iteration number of pbkdf2 be a security flaw? [closed]
I am now working on a project that involves saving two different pbkdf2 hashes on the server. i was wondering whether there is a mathematical connection between a 1000 iterations hash of a given ...
0
votes
2answers
241 views
What are the implications of reversing hashes
Today it was posited to me that
sha256 has a domain large enough to never encounter a collision and
that because it is such a large domain and given that a reverse function was created for it, that ...
5
votes
1answer
1k views
Source for up-to-date GPU/ASIC hash performance?
I am looking for CPU, GPU and/or ASIC performance stats on hash performance. Specifically SHA256 and Argon2i. I've googled and only came up with very limited anecdotal evidence. Considering that this ...
13
votes
1answer
9k views
John the ripper does not crack password
I'd like to attack a self-created sha256 hash with john --wordlist=
So far I've done the following:
$ echo 'testpassword' | sha256sum > mypassword
removed the tail of the output with vim
$ cat ...
1
vote
1answer
189 views
Attacks on “signatures” of the form sha256(message || secret)?
I am testing an application that generates signatures in the following way
signature = sha256(message || shared_secret)
I know that if the signature was constructed with the message appended to the ...
